01.03 · Concept
Passkeys & Phishing-Resistant Auth
Explain why a passkey cannot be phished the way a password or an OTP can, and what changes in your data model when you store one.
Passkeys replace reusable login secrets with origin-bound public key signatures. The server stores public verification data and credential metadata, not a password-equivalent value. A phishing site can collect a password or relay an OTP, but it cannot obtain a signature valid for the real site’s origin.
What this lesson answers
- why are passkeys resistant to phishing
- what does a server store for passkeys
- how do passkeys differ from OTP codes
Notes
A password is a shared secret: the user knows it and your server verifies it, usually by comparing a hash. That means an attacker can trick the user into typing it into a fake site, then replay it on the real site. OTP codes improve things, but they are still bearer secrets for a short time: if a fake site asks for the code and immediately forwards it, the attacker can log in before it expires.
A passkey works differently. During registration, the user’s device creates a public/private key pair for your site. Your server stores the public key and a credential identifier; the private key stays…
Common questions
- Why can a password be phished but a passkey cannot?
- A password is a secret the user can type into any page, including a fake one. A passkey uses a private key held by the user’s device to sign a fresh server challenge. That signature is tied to the real site’s origin, so a phishing domain cannot produce a response that verifies for the legitimate service.
- Are passkeys just passwords saved in a password manager?
- No. A saved password is still a reusable secret that can be revealed, copied, pasted, or submitted to the wrong site. A passkey is a cryptographic credential. The user does not know the private key, and the application verifies signatures using stored public data rather than comparing a submitted secret.
- What changes in the database when adding passkeys?
- The user record needs to relate to passkey credentials rather than a single password hash. Each credential stores a credential identifier, public key material, and operational metadata such as device details, counters, and timestamps. The private key is never stored by the application server and is not recoverable from the stored data.
Short definition: what is Passkeys & Phishing-Resistant Auth?