Glossary · Cryptography & authentication
Passkeys (WebAuthn / FIDO2)
Passkeys are public-key login credentials based on the FIDO2/WebAuthn standards: your device holds a private key and signs a per-site challenge, so there is no shared secret to phish, leak, or reuse across sites.
Each passkey is a keypair scoped to one origin. At login the site sends a random challenge; the authenticator — phone, laptop, or security key — signs it after local user verification (biometric or PIN). The server stores only the public key, which is worthless to steal, and the origin binding defeats phishing: a lookalike domain cannot request a signature valid for the real one.
Because private keys sync through platform keychains or stay on hardware, there is nothing for a user to type and nothing for a breach to expose. The residual risks move to account-recovery design and the security of the platform keychain itself.
Ciphera ID supports passkeys alongside OPAQUE passwords and TOTP — the password path itself is already unphishable-by-server since the server never receives it, and passkeys extend that property against lookalike-site phishing.