Passkeys use public key cryptography so the private key stays on the user’s device or authenticator and the server only stores the public key. They resist password phishing and credential stuffing, but defenders still need registration controls, device loss recovery, strong account recovery, and monitoring for unauthorised authenticator enrolment.
How passkey security works in practice
Passkey security rests on asymmetric cryptography. The relying party never receives the private key, so there is no password equivalent for an attacker to steal from the server side. That design changes the attack surface: success depends less on secret reuse and more on protecting registration, authenticators, recovery paths, and the policy around which devices can add new credentials.
In operational terms, the strongest property is that the browser or platform only releases a signature after the user proves presence and, on many devices, performs local user verification. That means the server can validate possession without learning the private key itself. For rollout and assurance details, NIST SP 800-63 Digital Identity Guidelines remains the most useful external reference point for phishing-resistant authentication and assurance levels.
What passkeys stop, and what they do not
Passkeys are designed to defeat the common failures of passwords, especially phishing, replay, credential stuffing, and large-scale password spraying. They do not magically solve account compromise if an attacker can abuse registration flows, trick a help desk, or enroll a new authenticator through a weak recovery process. The practical security question is therefore not only “is the login phishing-resistant?” but also “who can create trust in the first place?”
That distinction matters because passkeys shift the defender’s work from secret entropy to lifecycle control. If an organisation allows broad self-service recovery, weak identity proofing, or unmanaged device enrollment, an attacker can bypass the cryptographic strength of the passkey itself by attacking the surrounding process. Workforce Identity Security Guide and Passwordless and Passkeys Guide both help frame that operational boundary: the credential is strong, but the enrollment and recovery workflow still has to be governed.
Recovery, device loss, and authenticator enrolment are the real control points
Most passkey failures in practice come from the edges, not the cryptography. Device loss, replacement, browser sync behaviour, backup authenticator handling, and recovery by support staff all create paths where an attacker may impersonate the real user. A secure deployment therefore treats recovery as a high-value security function, not as a convenience feature to streamline support.
Monitoring is equally important. Unauthorised authenticator enrolment is often the earliest sign that a passkey-protected account is being targeted, especially when the attacker cannot directly phish the private key. Defender visibility should focus on new device registration, changes to recovery factors, abnormal location or session behaviour after enrolment, and repeated failed recovery attempts. For a broader view of how phishing-resistant authentication is rolled out and abused, MFA Guide provides useful context, and the publicised Twilio 0ktapus case shows why attackers often target the surrounding identity process rather than the token itself.
Risk and Threat Considerations
Passkeys reduce password theft risk, but they can still be undermined when attackers move to enrollment abuse, help desk social engineering, session theft, or compromised devices. The main security failure is not usually cryptanalysis, it is an attacker gaining a legitimate-looking path to register or recover a credential.
Failure mechanism: If recovery, device replacement, or new-authenticator enrolment is weak, an attacker can establish a new trusted authenticator without ever stealing the existing private key. That shifts the problem from password compromise to identity process compromise.
Impact: The account can still be taken over, with the same downstream effects as a password breach: unauthorised access, session abuse, data exposure, and persistent access through a newly enrolled authenticator.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | IAL — Identity Assurance Level | Passkeys are an assurance-controlled digital identity method. |
| Recommendation — Map passkey rollout to the required assurance level and phishing resistance. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Passkey lifecycle, recovery, and enrollment are authenticator management concerns. |
| IA-2 — Identification and Authentication (Organizational Users) | Passkey sign-in is an authentication control for users. | |
| IA-8 — Identification and Authentication (Non-Organizational Users) | External-user passkey authentication is governed by this control family. | |
| Recommendation — Govern issuance, replacement, revocation, and recovery of authenticators. Require phishing-resistant authentication for user access paths. Apply phishing-resistant authentication requirements to external identities. | ||
| CIS Controls v8 | CIS-5 — Account Management | Passkey enrollment, recovery, and account lifecycle depend on account governance. |
| Recommendation — Centralize account lifecycle control for passkey-enabled identities. | ||
Practitioner Guidance
What to verify: Confirm that passkey registration is bound to a strong, audited identity proofing step and that recovery cannot be completed through a low-assurance channel. If a support desk can add or reset authenticators without strong verification, the deployment is only partially resistant.
What to measure: Track new authenticator enrolments, recovery events, failed recovery attempts, and post-enrolment anomalies. A rise in these events is often more actionable than generic login failure metrics because it points to the control plane attackers are likely to abuse.
Common mistake: Treating passkeys as a full replacement for account governance. The correct mental model is that passkeys harden sign-in, but the organisation still owns identity lifecycle, recovery trust, and device change risk.
Practitioner takeaway: Passkeys are strongest when the cryptography, enrollment policy, recovery process, and monitoring all hold together, because attackers usually go around the private key rather than through it.