- A passkey is a login method that verifies you with a key stored on a device such as your phone or PC instead of a password. The original article explains that the browser mechanically compares the site address, and if it does not match, it does not show the key as a candidate, so login does not happen on a fake site.
- The server stores only the public key, and the private key never leaves the device. The original article stresses that fingerprint or face data is also not sent to the server and is verified on the device.
- The original article cites the Passkey Index released by the FIDO Alliance in 2025 October, saying that in a survey of 9 companies, the login success rate was 93% for passkeys and 63% for other methods, and the login time over 1 logins was 8.5 seconds versus 31.2 seconds. These figures were compiled by the FIDO Alliance and the research firm Liminal from numbers reported by participating companies.
- The weakness of passkeys is the account recovery process. If attackers exploit the recovery path, the strength of passkeys can be reduced, so the original article introduces measures such as registering two or more passkeys and sending an alert to the account owner during recovery.
O: For developers in charge of the login screen and recovery process, we suggest this check sequence: after registering two or more passkeys, test whether sign-in still works without one of the devices.
X: The login success rates and times in the original source are values that participating companies reported and that FIDO Alliance and Liminal collected, so they are not independently verified figures.