What is a passkey? How it works and why phishing fails
A passkey swaps the shared secret of a password for a key pair that only works on the real website. How signing in works, and how to stay in control when a phone goes missing.
The email says your bank account has been restricted. The page behind the link looks right, and its address is off by one letter. You type your password, and from then on two people know it. No password policy fixes this, because the secret you type is the secret the website checks. A passkey removes that secret, and in Encloq it takes on a second job as well.
A passkey is a sign-in credential based on the FIDO Alliance’s standards and the W3C’s Web Authentication standard, WebAuthn. It consists of two matching keys. The private key stays with you, on your device, in your password manager or on a security key. The website keeps the public key, which works like the specimen signature a bank holds on file: good for checking a signature, useless for producing one. Unlike the paper version, nobody can trace over it.
You unlock a passkey the way you unlock your phone, with your fingerprint, your face or the screen lock PIN. According to the FIDO Alliance, that biometric check never leaves the device; the website only learns that it succeeded.
Behind the familiar prompt, a short exchange takes place:
- The website sends a random challenge, new for every sign-in.
- Your browser notes which website is asking and offers only passkeys created for that site.
- You confirm with your fingerprint, face or PIN, and the device signs the challenge with the private key.
- The website checks the signature with the public key it stored when you created the passkey.
What crosses the network is a signature over one challenge, worthless a second time. If the website’s database leaked tomorrow, it would contain nothing anyone could sign in with, which is more than a table of password hashes can say.
Phishing works because people make reasonable mistakes. One-time codes help less than they seem to: a code typed into a fake page can be passed on to the real one within seconds, by software built for exactly that.
With a passkey, there is nothing to type. Each passkey is scoped to the website it was created for, and the browser enforces the scope, so a look-alike address simply gets no passkey. NIST’s authentication guidelines (SP 800-63B-4) call this phishing resistance, protection that does not rely on the vigilance of the person signing in, and name WebAuthn as an example.
| Password | One-time code | Passkey | |
|---|---|---|---|
| Works on a look-alike website | Yes | Yes, if relayed in time | No |
| Useful to whoever intercepts it | Yes | Until it expires | No |
| What the website stores | A password hash | A shared secret or your phone number | A public key |
Synced passkeys live in a password manager or your device’s built-in passkey store, which copies them, encrypted, to your other devices. Device-bound passkeys stay where they were created, for example on a security key you plug in or hold against your phone.
Both are sound. NIST accepts synced passkeys up to the second of its three assurance levels, provided they are stored encrypted and the sync account is protected by multi-factor authentication. Its highest level demands keys that cannot leave the device. A synced passkey is only as safe as the account that syncs it, so that account deserves the best protection you have.
The passkey on your phone also works on a computer that doesn’t have it. The browser shows a QR code, you scan it and confirm on the phone, and the phone checks over Bluetooth that it is actually nearby. A screenshot of the code is no use to someone on the other side of the world.
Most services give a passkey one job: proving that it’s you. Encloq gives it a second, because your files and messages are end-to-end encrypted. If your passkey supports a WebAuthn extension called PRF, it also computes a secret each time you confirm, one that only this passkey can produce. Your device uses the secret to open your encryption key, which Encloq stores sealed. The secret never reaches Encloq, so we hold your key and cannot open it.
In the app, these are two steps. “Sign in with passkey” opens your account with everything still encrypted; “Unlock with passkey” makes your files and messages readable on that device. A passkey you add later signs you in at once but opens your content only after you copy your key to it. Not every browser or passkey provider supports PRF, and Encloq tells you during setup if yours doesn’t.
A lost phone is rarely an emergency, because its passkeys are useless without unlocking it. What counts is getting in elsewhere and shutting the phone out. In Encloq, from a device you still have:
Sign in with another passkey.
The one on your computer, in your password manager or on a security key.
Remove the lost passkey.
In Settings › Credentials, open its ⋯ menu and choose “Remove”.
End its session.
In Settings › Sessions, choose “Revoke session” for that device.
Make a new spare.
Add a passkey on the replacement device and copy your key to it, so that two passkeys can unlock your data again.
A new passkey cannot bring back your content
With no passkey left, a code sent by email gets you back into your account, as the passkey guide shows. Your content is another matter. Encloq cannot recover your encryption key, so if no passkey or password that holds it remains, your files and messages stay encrypted, for us as much as for you. Keep at least two passkeys that can unlock your data.
An account is only as safe as its weakest way in. Encloq puts passkeys first but lets you add a password for a device that can’t use one, and a password can be guessed, reused or phished. If you add one, protect it with an authenticator app, keep it sign-in only unless it must open your data, and remove it once you no longer need it.
Three more things a passkey does not take care of:
- Malware on an unlocked computer acts inside your session, after the sign-in. Updates and a screen lock help here; the login method doesn’t.
- A link opened inside an email or messaging app often lands in a built-in browser that can’t use passkeys. Encloq notices and offers to open the page in your regular browser.
- Passkeys synced by one platform don’t automatically appear on another. A cross-platform password manager or a security key spares you that surprise.
Are passkeys quantum-safe?
Not yet. The passkeys in use today rely on classical signatures, and so does sign-in to Encloq. A recorded sign-in holds nothing to decrypt later, but the standards will still need post-quantum signatures before a capable quantum computer exists. Encloq’s post-quantum protection covers key exchange and content signatures; the article on post-quantum cryptography explains the difference.
Set up your passkeys in Encloq
The help guide walks through creating your passkey, adding a second one and what to do when a device goes missing.