The Lost-Device Problem
Standard FIDO2 hardware authenticators (like a YubiKey) store private keys on the physical device. This is maximally secure — the key cannot be extracted — but it creates a usability problem: if you lose the device, you lose access to every account registered with it. Organizations deploying hardware keys must maintain complex recovery workflows, backup keys, and helpdesk procedures.
Platform authenticators (TouchID, Windows Hello) had the same problem. Register a Passkey on your MacBook, lose the MacBook, and you need to go through account recovery for every service you used it with.
What Passkeys Add
Passkeys are FIDO2 credentials with one additional property: the private key material is encrypted and synchronized via the platform's cloud infrastructure.
- Apple: Passkeys sync through iCloud Keychain, protected by end-to-end encryption. Apple cannot read your private keys.
- Google: Passkeys sync through Google Password Manager, with similar end-to-end encryption guarantees.
- Microsoft: Windows Hello for Business supports Passkey sync through Microsoft accounts.
- Third-party managers: 1Password, Dashlane, and others now support storing and syncing Passkeys across platforms.
The sync fabric means: buy a new iPhone, restore from iCloud, and all your Passkeys are immediately available. No re-registration required.
Cross-Platform Authentication: The QR Code Flow
Passkeys also solve a subtler problem: what if you want to log into a Windows laptop using a Passkey stored on your iPhone?
This is handled by the CTAP2 (Client to Authenticator Protocol) cross-device flow:
- On the Windows laptop, you click "Sign in with a Passkey from another device."
- The browser displays a QR code encoding a one-time connection URL.
- You scan the QR code with your iPhone's camera.
- The iPhone and laptop establish an encrypted Bluetooth channel (proximity is verified — the QR code alone is not enough; the devices must be physically near each other).
- The iPhone performs the biometric check (FaceID) and signs the challenge.
- The signed response travels back to the laptop over the Bluetooth channel, and the browser completes the authentication.
The Bluetooth proximity requirement prevents remote attackers from abusing a stolen QR code — they would need to be physically next to you.
A common interview question: "Aren't Passkeys less secure than hardware keys because the private key is synced to the cloud?" The nuanced answer: it depends on the threat model. Synced Passkeys are protected by end-to-end encryption — the cloud provider cannot read them. The attack surface shifts to the platform account (Apple ID, Google account) rather than the physical device. For most users and most enterprise scenarios, the usability gain outweighs the marginal security reduction. For high-security environments (government, critical infrastructure), hardware-bound FIDO2 keys (YubiKey) remain the gold standard.