Verify a sign-in with a passkey.
Passkeys replace reusable passwords with site-bound public-key credentials. Learn why that resists phishing, how sign-in works, and when a user-verified passkey can satisfy multifactor authentication (MFA).
Why this lesson?
A user wants a safer, easier sign-in than a reusable password. The site has already registered a passkey and now asks the authenticator to prove possession of the private key for this site and, when policy requires it, verify the user locally.
Learning goal and prerequisites
Request a new challenge
The server starts a new sign-in attempt by creating a fresh random challenge. A challenge makes this ceremony unique, so a signed response from an older sign-in cannot simply be replayed. The server also states which site the credential belongs to and whether local user verification is required for this sign-in.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Passwords create two related problems. They are reusable secrets, so a person can type the same secret into the real site or a convincing fake site. They are also difficult for people to manage safely, which leads to reuse, weak choices, and password-reset risk. Passkeys were designed to remove the reusable secret from normal sign-in and make phishing much harder.
A passkey is useful when a site wants strong user authentication without asking the user to remember or type a password. During registration, an authenticator creates a private key and a matching public key for that site. The private key stays protected by the user’s device or credential provider. The site stores the public key. During sign-in, the site sends a fresh challenge and the authenticator signs it with the private key.
The phishing resistance comes from how the credential is bound to the relying party, which is the site or application using the passkey. The browser and authenticator use the expected site identity when deciding whether the credential can be used. A fake site cannot simply ask the user to type the private key, because the private key is never entered into a page and is not sent to the server. The server verifies the signature with the stored public key.
A passkey can also satisfy more than one authentication-factor category when the authenticator requires local user verification before using the private key. Possession of the authenticator supplies one factor category, while a required personal identification number (PIN) or biometric check supplies another. That is why a user-verified passkey can satisfy multifactor authentication (MFA) requirements in many deployments. The exact assurance still depends on policy, authenticator behavior, synchronization, recovery, and whether user verification is actually required.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.