What are passkeys?

Passkeys and passwordless authentication are the future of cybersecurity. The technology is proven and enterprises today are exploring how best to deploy them in their organization. Even still, there are many questions to ask and considerations to make as you explore their potential.

Here, we’ve gathered all of the top questions about passkeys and passwordless authentication to inform your research. Browse our passkeys FAQ below.

Ready to see how passkeys can strengthen your security posture? Explore our self-guided demo.

1. What are passkeys?

Passkeys are a passwordless sign-in method that replaces passwords with cryptographic credentials stored on a user’s device. Users authenticate with a device unlock method such as biometrics or a PIN, rather than typing a password.

Passkeys utilize public key credentials designed to eliminate shared secrets. When a user enrolls a passkey, the device generates a key pair. The private key stays on the device (or is stored in a secure enclave or trusted platform module (TPM)), and the service stores the public key. At sign-in, the server sends a challenge; the device signs it using the private key; the server verifies the signature with the public key.

Passkeys, however, differ from passwords and multi-factor authentication (MFA) in ways beyond the user experience (UX). They operate on a different security model entirely. Passkeys eliminate reusable shared secrets. The credential is origin-bound (tied to the legitimate site/app), which helps block phishing domains.

From an enterprise perspective, passkeys matter because they address the most expensive identity problems at once:

• Phishing-driven account takeover
• Credential stuffing
• Cost and frustration of password resets

Review this table to parse the differences passkeys, passwords, and MFA.

2) What is a FIDO passkey? What is a FIDO2 passkey?

A FIDO passkey is a FIDO-based passwordless credential built on FIDO2 standards developed by the FIDO Alliance. It uses public key cryptography to authenticate users without requiring a password. Instead of entering a password, users approve sign-in using a trusted authenticator. such as a phone, laptop, or security key, in conjunction with a fingerprint, face scan, or device PIN.

• The private key remains securely on the user’s device or authenticator
• The public key is stored by the service

Authentication occurs through a challenge–response process, where the device signs a server-provided challenge using the private key.

FIDO2 is the underlying standards framework that enables passkeys. It consists of two main components:

• WebAuthn (Web Authentication): A web standard API used by browsers and applications to create and use credentials
• CTAP (Client to Authenticator Protocol): A protocol that enables communication between the client device (browser/OS) and external or built-in authenticators

In practice, the terms “passkey,” “FIDO passkey,” and “FIDO2 passkey” are often used interchangeably to describe the same modern passwordless authentication system.

3) How do passkeys work?

Passkeys work by proving possession of a device-held private key instead of validating a user-entered password. The service stores a public key; the user’s device holds the private key. Therefore, the authentication is a challenge–response signature verified by the server.

Here’s the flow in practical terms:

1. Registration (enrollment): When a user creates a passkey, the authenticator (built into a device or a security key) generates a unique key pair for that relying party (your app/site). The public key is registered with the service; the private key remains protected by the authenticator.
2. Sign-in: The relying party returns a cryptographic challenge. The authenticator signs that challenge with the private key after the user completes local user verification such as a biometric or device PIN. The service then verifies the response with the public key.

Two properties matter most for security teams:

• No shared secrets traverse the network: Even if an attacker observes traffic there is no reusable password, OTP, or shared secret to intercept and replay.
• Origin binding: The browser and platform enforce the credential's binding to the relying party ID (RP ID), ensuring that a passkey created for one domain cannot be used to authenticate to another domain.
• For enterprises, the “how it works” question quickly becomes “how it works at scale.” There are three user journeys that banks in particular must design and test: onboarding/enrollment, sign-in, and account recovery, because recovery is where many programs inadvertently reintroduce weak links.

Passkeys themselves are proven; what can fail is the operational execution: device changes, shared device realities, lifecycle revocation, and migration from existing MFA. The cryptography is clean and standardized (WebAuthn/FIDO2), but success requires designing the surrounding lifecycle, so users don’t get stuck and security teams don’t create exceptions that undermine the model.

4) Are passkeys more secure than passwords?

Yes. Passkeys are more secure than passwords, because they are phishing-resistant and eliminate reusable secrets. Passwords are knowledge-based shared secrets; passkeys are cryptographic credentials tied to a device and verified locally.

This matters:

• Phishing resistance: With passwords (and many OTP flows), users can be tricked into entering secrets on a phishing site designed to impersonate a trusted brand. Passkeys rely on origin binding and device-mediated credential selection, so the credential cannot be presented to an imposter.
• Breach impact reduction: Attackers target password databases to steal sensitive information and reuse passwords for account takeover or other schemes. With passkeys, servers store only the public keys, which are not sufficient to authenticate without the private key.

Security analyses show that the strongest value of passkeys is how they reduce scalable attack classes (credential stuffing, phishing kits, mass compromise patterns) by removing the shared-secret model entirely. However, while passkeys significantly improve security over passwords, they shift risk into other areas of identity design.

• Recovery becomes critical: If recovery is weak (e.g., easily socially engineered), attackers will target it as the bypass path. This is why we consistently frame passkey programs around lifecycle design, not just login.
• Authenticator assurance varies: Security differs between device-bound, synced, and hardware-backed passkeys, which may be relevant for high-assurance or regulated use cases. Choose the model that matches your use case, sometimes combining models with policy.

Passkeys dramatically reduce the most common credential-based attacks, but you still need good identity hygiene in the form of strong policies, device posture awareness, and robust recovery processes to maintain a secure system.

5) Will passkeys replace passwords?

Passkeys are widely expected to become the primary replacement for password-based login in many consumer and enterprise use cases. Platform vendors and standards bodies position passkeys as a practical replacement for password-based sign-in, rather than just an add-on. However, enterprises should expect a phased transition where passwords and other methods coexist.

In practice, the transition will happen in stages:

1. Passkeys are added as an option for compatible users/devices while keeping existing methods.

2. Nudges and UI prompts begin to encourage passkey enrollment at high-intent moments, such as after successful login or account creation. This will shift default behavior over time.

3. Passwords are often retained as fallback recovery mechanism

4. From there, the organization can progressively sunset passwords where business and compliance allow.

Passkeys are highly reliable when properly implemented, but operational challenges arise in lifecycle management areas such as enrollment, device changes, shared devices, contractor access, and account recovery. For banking and other high-assurance environments, OneSpan recommends a controlled rollout:

• Design the end-to-end authentication and recovery journeys
• Allow opt-in adoption initially
• Nudge adoption over time
• Roll out by user segment, region or platform
• Plan for coexistence with other methods during transition

So yes: passkeys are on a path to being the primary authentication method. But our guidance to enterprise organizations is to plan the transition deliberately and treat recovery and lifecycle management as first-class requirements.

6) What is passwordless authentication?

Passwordless authentication refers to authentication methods that do not require the user to enter a password. Instead of “something you know” (a memorized secret), passwordless methods typically rely on device possession plus local user verification (biometric or PIN), often backed by cryptography. Passkeys are the most prominent standardized form of passwordless authentication today.

It’s helpful to separate passwordless into two practical categories:

• Phishable passwordless (e.g., magic links or OTPs): These remove the password typing step but still rely on interceptable or replayable factors.
• Phishing-resistant passwordless (e.g., FIDO/WebAuthn passkeys): These avoid shared secrets and use origin-bound cryptographic credentials that require local user presence.

For IT leaders, the key is that passwordless is more than a UX enhancement. Passwordless authentication, if implemented strategically, promises to reduce identity risk and operational overhead.

Password systems create ongoing operational burden (password management, resets, lockouts, account recovery load) and invite common attack patterns (credential reuse and phishing). Passwordless approaches aim to remove those failure modes by replacing shared secrets with device-mediated cryptographic authentication.

However, passwordless cannot be exclusive to the login step and must be designed around the account lifecycle, including:

• Enrollment
• Revocation
• Replacement
• Recovery

Security is moving beyond point-in-time login toward more continuous, context-aware models that consider what happens after login, across sessions, transactions, and real-time risk.

If you’re evaluating passwordless for an enterprise program, the practical questions to answer early are:

• Which workflows must be phishing-resistant (privileged access, high-risk transactions)?
• What device populations and platforms must be supported?
• What recovery and fallback methods are acceptable without reintroducing phishing risk?

Consider passwordless the destination; passkeys as the most standardized path; and operational design as the method to making passwordless functional for the enterprise.

7) What is the difference between passkeys and passwords?

The key difference is that passwords are shared secrets, while passkeys are device-based cryptographic credentials that are never shared.

With passwords, authentication depends on something a user knows, commonly a string of characters that must be transmitted to a server and verified. This model creates several well-known risks. Passwords can be:

• Reused
• Guessed
• Phished
• Stolen from breached databases

Passkeys change this model entirely. Instead of sending a secret to a server, the user’s device proves identity using a private key stored locally, while the server holds only a public key. During authentication, the device signs a challenge, and the server verifies it without receiving sensitive credentials.

This approach has several important advantages over passwords:

• No credential reuse: Each passkey is unique to a specific service
• No server-side secrets: Databases do not store exploitable login credentials
• No phishing vector: Users are not entering secrets that can be intercepted

From an enterprise perspective, this represents a fundamental shift in identity architecture. Password security depends heavily on user behavior. Users must select strong passwords, rotate their passwords periodically, and avoid reuse across applications. Passkey security, however, is enforced by the underlying system and cryptographic model bypassing the weaknesses of user behavior entirely. In addition to removing user friction, passkeys eliminate entire categories of risk at scale, particularly those tied to shared secrets and replayable credentials.

8) Are passkeys phishing-resistant?

Yes. Passkeys are designed to be phishing-resistant, because they are tied to a specific domain and cannot be used on fraudulent websites.

Traditional phishing attacks work by tricking users into divulging sensitive information, such as passwords, OTPs, or MFA approvals, into a spoofed website. Because these credentials can be intercepted, approved, or relayed, attackers may be able to misuse them in real time.

Passkeys break this attack model. Each passkey is cryptographically bound to a specific relying party (domain). When a user attempts to sign in, the operating system and browser ensure that the credential is only presented to the legitimate domain it was created for.

If a user lands on a phishing site:

• The domain does not match
• The device will not offer the passkey
• The passkey's private key never leaves the authenticator, and the phishing site cannot obtain a valid authentication response for the legitimate service
• This significantly reduces the risk of credential phishing by removing the need for users to enter or approve reusable authentication credentials

Additionally, passkeys can reduce reliance on other commonly targeted authentication factors such as:

• Passwords
• One-time passcodes (OTPs)
• Push-based MFA approvals

For enterprise security teams, this is a critical advantage. Phishing remains one of the most common initial attack vectors, and passkeys directly target that weakness by removing the reusable credential layer entirely.

However, phishing resistance does not eliminate all identity risks. Attackers may shift toward social engineering in recovery flows or device compromise. Organizations must also address secure enrollment, account recovery, device replacement, credential revocation, and policy enforcement. A successful passkey strategy requires lifecycle management that protects users throughout the entire authentication journey, not just at login.

9) Can passkeys be hacked?

Passkeys are significantly more resistant to attack than passwords and OTP-based authentication because they eliminate reusable credentials and rely on strong cryptographic authentication.

Unlike passwords, there is no secret stored on a server that can be stolen and reused. Even if an attacker breaches a database, they only obtain public keys, which cannot be used to authenticate without the corresponding private key stored on the user’s device.

Additionally, passkeys reduce several major attack vectors:

• Credential theft: No password, OTP, or other reusable secret is transmitted during authentication
• Replay attacks: Each authentication uses a unique challenge
• Brute force attacks: No password to guess

Authentication requires access to the user’s device and successful local verification (biometric or PIN), which significantly increases the difficulty for attackers.

That said, it’s important to approach this question with nuance. The technology is strong, but weak operational design is where failures can occur. Passkeys don’t eliminate all possible risks. Rather the risks shift from one form to another. For example:

• Device compromise and account takeover through compromised endpoints become more relevant considerations
• Account recovery processes become a key attack surface
• Synced passkeys introduce dependency on provider security models

In practice, attacks against passkeys are not impossible, but they are far less scalable and economically viable compared to password-based attacks.

For enterprise organizations, passkeys dramatically reduce exposure to large-scale attacks such as phishing campaigns, credential stuffing, password spraying, and account takeover attempts based on stolen credentials. Security teams can then focus on higher-assurance controls for device trust, recovery, lifecycle management, adaptive authentication, and high-risk transactions.

The result is a significantly reduced attack surface, even if no authentication system is completely invulnerable.

10) Do passkeys replace MFA?

Passkeys can serve as a primary authentication method in many scenarios, reducing reliance on traditional MFA methods such as passwords combined with OTPs or push notifications.

When a user signs in with a passkey, the process inherently combines multiple factors:

• Something you have: the device containing the private key
• Something you are or know: biometric verification or PIN
• This means passkeys can provide phishing-resistant multi-factor authentication in a streamlined user experience, without necessarily requiring additional authentication steps during routine sign-in.

However, in enterprise environments, the answer is more nuanced. While passkeys can replace password and OTP combinations, they don’t eliminate the need for:

• Risk-based authentication (adaptive controls)
• Step-up authentication for sensitive actions
• Policy enforcement based on device, context, or transaction risk

Authentication should be viewed across the full lifecycle, not just login. In high-risk scenarios, organizations may still require additional verification steps or apply stronger policies. The key shift is in simplifying MFA. Instead of layering multiple factors, passkeys consolidate authentication into a stronger, more user-friendly model.

For IT teams, this has several benefits:

• Reduced user friction
• Lower risk of MFA fatigue attacks
• Improved login success rates

In fact, according to FIDO Alliance research, passkeys have a 30% higher sign-in success rate compared to traditional MFA methods. Many organizations adopt passkeys as their primary authentication method, while retaining additional controls for high-assurance scenarios.

Passkeys are best viewed as one authentication method within a broader identity and access strategy. They can simplify and strengthen user authentication, while adaptive policies, step-up authentication, transaction verification, and recovery controls continue to play important roles in protecting high-risk activities.

11) Why are enterprises adopting passkeys as part of their authentication strategy?

Enterprises are adopting passkeys to reduce phishing risk, improve user experience, and modernize authentication at scale. Around the world, passkey momentum is building. In April 2026, the UK government’s technical authority on cybersecurity said:

“As we aim to accelerate the UK’s cyber defenses at scale, moving to passkeys is something all of us can do to improve the security of everyday digital services and be prepared for modern and future cyber threats.” 

The movement towards passkeys and passwordless authentication is in response to the persistent problem with passwords, namely:

• Security risk: Passwords are vulnerable to phishing, reuse, and credential stuffing
• User friction: Complex login processes reduce productivity and conversion
• Operational cost: Password resets and support tickets consume significant resources

Passkeys can help address all three challenges. By reducing reliance on passwords and introducing phishing-resistant authentication, they can significantly reduce credential-based attacks while simplifying the user experience.

At the same time, they simplify the login experience. Instead of typing credentials or waiting for codes, users authenticate with a quick biometric or device unlock, which improves success rates and reduces abandonment.

Operationally, this leads to measurable benefits:

• Fewer password reset requests
• Reduced help desk workload
• Lower infrastructure costs associated with OTP delivery

For enterprise IT leaders, passkeys represent an important step toward phishing-resistant authentication. However, successful deployments require more than simply enabling passkeys. Organizations must also address enrollment, recovery, lifecycle management, adaptive authentication, policy enforcement, and high-assurance use cases. Successful adoption relies on thoughtful execution and applying the right authentication approach for different users, devices, and risk scenarios. Taking a full lifecycle approach to authentication modernization addresses challenges such as:

• Rolling out across diverse devices and platforms
• Managing user enrollment and recovery
• Integrating with existing identity systems
• Applying appropriate authentication policies and assurance levels for different risk scenarios

12) What is the best way to deploy passkeys in an enterprise?

Treat passkeys as a rollout program with considerations for policy, UX, and lifecycle, rather than a feature upgrade. Enterprise success depends on how the organization operationalizes enrollment, recovery, device change, and staged enforcement.

Here is a practical deployment sequence that maps to real-world outcomes:

1. Design and test the “three moments” that make-or-break adoption: Because you are trying to change user behavior, ensuring a positive experience during onboarding/enrollment, day‑to‑day sign‑in, and account recovery is critical.

2. Roll out in phases and measure: Rather than enabling passkeys everywhere at once, choose a platform or region to gather metrics and operational feedback, such as support load, success rates, latency, and drop-off points. Though passkeys are a proven technology, deployments can struggle when teams underestimate operational requirements beyond the initial login. Considerations for devices, contractors, shared endpoints, and migration from legacy MFA all play an important role in a successful deployment.

3. Plan for coexistence, then tighten policy gradually: Most enterprises must run passkeys alongside other methods for a period of time. The goal is to introduce passkeys as part of a broader authentication strategy, expanding adoption where they deliver the greatest security and user experience benefits, while maintaining alternative authentication methods and controlled fallbacks for business, operational, and risk-based scenarios.

4. Take a “modernize without disruption” approach: Introduce passkeys alongside existing methods, expand adoption over time, and apply policy-driven authentication based on risk.

5. Use campaigns for adoption, especially for privileged users: We recommend a structured approach. Begin with a readiness assessment, establish a deployment plan, offer guided steps, and apply enforcement once prerequisites are met (initially targeting admin roles).

6. Decide early. Build, buy, or hybrid: Many teams can ship an MVP quickly, but know that initial versions will require maintenance, multi-environment support, integration, and agility to align with evolving standards. A hybrid strategy where you customize the user experience while relying on proven authentication foundations is often the best approach.

To learn more about implementing passkeys, explore our ebook, Strengthen Authentication with Passkeys without Disrupting What Works.

13) What is the biggest barrier to passkey adoption?

The biggest barrier to passkey adoption is its execution across the account lifecycle. Enterprises typically stall on enrollment design, recovery, device changes, platform differences, and the organizational change needed to run passkeys at scale.

Passkeys reduce or eliminate reliance on passwords, but they don’t eliminate identity operations. In fact, they move the “hard work” to areas organizations often treat as afterthoughts:

• Enrollment and timing: Successful passkey rollouts treat adoption as a UX problem. If organizations prompt users at the wrong time, they are more likely to ignore the option, even if the implementation is technically correct. Focus on production realities, such as enrollment friction, device loss, and scaling, rather than the cryptography itself.
• Recovery and device changes: Recovery is the stress test of any passwordless strategy. If users get locked out after a phone replacement or a laptop refresh, they will revert to legacy methods, creating exceptions that undermine your security posture.
• Mixed environments (and non-personal devices): Many IT teams initially imagine passkeys only in a personal-device model. Real enterprises have shared workstations, contractors, managed endpoints, and high-assurance roles. “Platform authenticator only” thinking can fail in real environments where hardware-backed options or more nuanced credential strategies are needed.
• Lack of clarity on rollout strategy: FIDO Alliance research notes that organizations often cite complexity, costs, and a lack of clarity about implementation as their barriers to adoption. This essentially translates to uncertainty about how to execute the rollout in manageable phases.

14) Do passkeys work across devices and platforms?

Yes. Passkeys can work across devices and platforms, but the user experience depends on how the passkey is stored and how cross-device sign-in is handled. In practice, enterprises need to plan for both synced passkeys (multi-device convenience) and cross-device authentication (using a phone to sign in on a different device).

There are three common patterns to consider:

1. Synced passkeys (same ecosystem): A passkey created on one device can be available on other devices that share the same credential provider ecosystem, e.g., the user’s platform credential manager. This tends to be the least-friction experience when it’s available.

2. Cross-device sign-in (QR/proximity flows): If the signing-in device doesn’t have the passkey locally, the user can often authenticate using a second device that does (typically a phone), with a QR-based flow and proximity checks.

3. Enterprise-specific constraints: In corporate environments, the most important questions are whether the passkey process is consistent and governable. We encourage teams to stage rollouts by platform or region to measure what users actually experience and to avoid assuming every OS/browser combination behaves identically.

From a security perspective, cross-device support doesn’t require weakening the model. The core security properties remain the same: private keys stay protected by the authenticator, authentication remains bound to the relying party, and user verification is typically required before authentication is completed.

Practical enterprise takeaway: You can support multi-device access without relying on passwords as the primary recovery mechanism, but you must design the "device change" and "device mismatch" moments explicitly with particular attention to creating clear UX cues, establishing supported recovery and fallback methods aligned to policy, and monitoring adoption and support trends.

15) What is the difference between synced and device-bound passkeys?

Synced passkeys prioritize multi-device convenience, while device-bound passkeys prioritize tighter device control and higher assurance. Both use the same fundamental passkey cryptography; the difference is how the private key is managed across devices.

• Synced passkeys: These passkeys are designed so users can sign in across multiple devices without re-enrolling on each device. That usability advantage can be decisive for broad adoption, especially in customer authentication and general workforce contexts. However, because the passkey can be restored to new devices through the provider’s ecosystem, security teams should treat the provider’s account protection and recovery methods as part of the trust boundary.

  Synced passkeys are convenient and remain protected by encryption and user verification, and this model naturally emphasizes usability and portability.

• Device-bound passkeys: This model anchors passkeys to a specific device or authenticator and generally are not copied between devices. This reduces portability, but it also reduces the avenues by which credentials can appear on an unexpected device. For many workforce and regulated environments, device-bound passkeys can offer stronger assurance and greater enterprise control. This is particularly relevant for sensitive systems and regulated scenarios.

You can also see this distinction reflected in external guidance around assurance levels. NIST-related guidance generally recognizes that synced passkeys can support AAL2 requirements when implemented with appropriate controls, while hardware-bound authenticators may support higher assurance requirements, including AAL3 scenarios.

Enterprises typically need a segmented strategy: broad adoption with synced passkeys where usability matters most, and higher-assurance device-bound or hardware-backed credentials where control and assurance are required. This aligns with our recommendation to combine authentication methods flexibly and apply policy-driven decisioning based on user, device, and context.

16) Should my organization use synced or device-bound passkeys?

Most organizations should use a blended approach: deploy synced passkeys for broad adoption and use device-bound (or hardware-backed) passkeys for high-assurance roles and sensitive actions. The right choice depends on your risk model, device landscape, and compliance requirements.

Consider this practical selection framework to inform your decision:

• Use synced passkeys when your priority is scale and user experience: If you need rapid adoption across a diverse population, synced passkeys reduce friction. Users can access accounts across devices without repeating enrollment on every endpoint.

  This model is especially suitable when the organization needs broad coverage and the risk profile is moderate, assuming the provider ecosystem and recovery are sufficiently protected.

• Use device-bound passkeys when you need tighter control and stronger assurance: For privileged admins, sensitive data access, regulated workflows, or environments where credential portability is a concern, device-bound passkeys can reduce the credential “sprawl” problem by anchoring credentials to known authenticators.

  Device-bound passkeys are the stronger option for workforce authentication where enterprise control matters.

• Match assurance levels to roles and actions. NIST assigns AAL2 for synced passkeys (with proper controls) and AAL3 for device-bound passkeys in dedicated hardware.

  This supports the enterprise use case of needing higher assurance for privileged roles and allowing broader usability for general staff.

• Don’t ignore rollout reality. Even the best credential strategy fails if deployment ignores lifecycle operations, namely enrollment, recovery, device change, and coexistence during migration.

  Start with a phased rollout, test onboarding/sign-in/recovery, measure outcomes, and evolve policy-driven enforcement over time.

17) How do passkeys improve user experience?

Passkeys improve user experience by removing the need to remember, manage, or enter passwords while making authentication faster and more reliable.

For most users, authentication today is a friction point. Password complexity requirements, MFA challenges, and recovery flows create multiple failure points that slow access and increase frustration. Passkeys simplify this dramatically by shifting authentication to a device-native interaction, typically a biometric or PIN prompt.

From a usability standpoint, the improvement comes from:

1. Reduced cognitive load: Users no longer have to create, remember, or store passwords. This eliminates common issues like password reuse, lockouts, and reset cycles.

2. Faster login experience: Instead of typing credentials or waiting for a one-time code, users authenticate in a single step. Passkey login success rates and speed outperform traditional password and MFA flows.

3. Higher success rates: Login failures are one of the largest sources of friction in digital journeys. Passkeys reduce this by eliminating typing errors, expired passwords, and MFA delivery issues (e.g., SMS delays or app failures).

From an enterprise perspective, user experience is directly tied to costs and overall security. Poor UX leads to:

• Password reuse and weak credentials
• MFA fatigue
• Increased support tickets

Passkeys address these by making the secure option the easiest option.

However, it’s important to keep the full end-to-end journey in focus, including enrollment and recovery. The login screen is only the starting point. User experience breaks down if recovery is confusing or device changes aren’t handled smoothly.

18) Do passkeys reduce IT and security costs?

Yes. Passkeys can significantly reduce IT and security costs by eliminating password-related overhead and reducing attack-related losses.

One of the largest hidden costs in enterprise identity systems is password lifecycle management:

• Password resets
• Account lockouts
• Help desk support
• MFA delivery infrastructure (e.g., SMS, push)

Passkeys remove a large portion of this overhead, because there are no passwords to reset or manage. Enterprises can achieve:

• Fewer sign-in related support tickets
• Reduced reliance on SMS or OTP infrastructure
• Faster authentication workflows

This matters, because credential compromise remains one of the most common and costly attack vectors. By eliminating reusable credentials, passkeys reduce the frequency and scale of these incidents.

However, it’s important to balance this with initial investment considerations:

• Integration with existing IAM systems
• Deployment planning and rollout
• User education, user onboarding and change management
• Support for legacy authentication systems and recovery flows

While organizations recognize the benefits, some hesitate due to perceived complexity and unclear implementation strategies. This is where OneSpan can help. Instead of focusing only on authentication technology, we emphasize:

• Lifecycle management
• Deployment orchestration
• Integration with existing environments

Through this approach, enterprises can lower costs and create a more predictable and sustainable identity model.

19) Are passkeys compliant with enterprise and regulatory standards?

Yes. Passkeys align with modern enterprise security standards and are increasingly recognized in regulatory frameworks as phishing-resistant authentication.

Authentication standards bodies have evolved to reflect the shift toward passwordless methods. For example, guidance based on NIST SP 800-63 indicates that passkeys meet important authentication assurance requirements when implemented correctly.

Specifically:

• Synced passkeys can support AAL2 requirements when implemented with appropriate controls
• Hardware-backed device-bound authenticators may support higher assurance requirements, including AAL3 scenarios, depending on the implementation
• This reflects a broader industry trend: moving away from password-based systems toward phishing-resistant authentication as a baseline requirement, particularly in regulated industries such as financial services

From a compliance perspective, passkeys support several key objectives:

• Strong multi-factor authentication
• Protection against credential replay and phishing
• Secure handling of authentication secrets (no server-side password storage)

Additionally, passkeys integrate well with zero-trust architectures, where authentication must be continuously verified rather than assumed.

However, compliance is not achieved by technology alone. Organizations must still ensure:

• Proper identity verification at onboarding (identity assurance)
• Secure device and authenticator management
• Strong recovery processes

Authentication assurance (AAL) and identity assurance (IAL) are separate considerations. Strong authentication alone is not sufficient if identity verification is weak.

The takeaway for IT leaders:
Passkeys align well with modern security and compliance requirements and are increasingly becoming the expected standard for phishing-resistant authentication. But achieving compliance requires combining passkeys with the right operational controls and governance.

20) How do passkeys support zero trust security?

Passkeys align closely with zero trust principles by removing implicit trust and enforcing strong, device-based authentication at every access point.

Zero trust is built on a simple idea: never trust, always verify. Traditional password-based systems undermine this principle, because they rely on static credentials that can be reused across sessions and environments.

But, passkeys are not a standalone zero trust solution. They are a foundational building block that strengthens identity assurance, which is at the core of any zero trust architecture.

Passkeys reinforce zero trust in several ways:

1. Eliminate reusable credentials: Passwords can be stolen and used anywhere. Passkeys are cryptographically linked to a specific domain and require device-based verification, making them far harder to reuse or replay.

2. Enforce strong user presence: Authentication requires interaction with the user’s device (biometrics or PIN), ensuring that access is tied to real-time user presence rather than merely credential possession.

3. Support continuous authentication models: Passkeys can be integrated into adaptive authentication systems, where access decisions are based on context (device, location, risk level), rather than a one-time login event.

From an enterprise architecture perspective, passkeys fit naturally into identity-centric security models, because they:

• Reduce reliance on perimeter-based defenses
• Strengthen identity as the primary control layer
• Enable phishing-resistant authentication across applications

The adoption of passkeys is also aligned with broader regulatory and industry trends pushing toward phishing-resistant methods as the baseline for secure access.

Zero trust extends past the login step, however. It includes session monitoring, transaction verification, and adaptive controls. The future of security and the success of passkeys require a movement beyond perimeter protections to continuous, context-aware identity verification.

21) What is the future of passkeys and passwordless authentication?

The future of authentication is increasingly passwordless, with passkeys emerging as a leading standard for phishing-resistant, user-friendly authentication.

The need for better security, improved user experience, and regulatory alignment is driving widespread adoption and active deployment of passkeys across industries.

Several trends are shaping the next phase of adoption:

1. Standardization across platforms: Passkeys are supported across major ecosystems, enabling consistent experiences across devices and applications.

2. Shift to phishing-resistant authentication: Regulators and standards bodies are increasingly emphasizing phishing-resistant authentication methods, making them an important part of modern authentication strategies.

3. Expansion beyond login: Authentication is evolving from a single login event to a continuous process. Future implementations will increasingly apply stronger authentication and verification controls at key moments such as:
a. High-risk transactions
b. Privileged access requests
c. Sensitive account actions

4. Operational maturity becomes the differentiator: The market has moved past “what are passkeys?” to “how do we deploy them effectively?” The challenge now is execution at scale.

Looking ahead, the organizations that succeed will be those that:
a. Integrate passkeys into broader identity strategies
b. Design lifecycle management from the start
c. Adapt authentication dynamically based on risk

The future is a more intelligent, resilient, and user-centric authentication model built on phishing-resistant authentication, adaptive decisioning, lifecycle management, and continuous trust evaluation. Passkeys will play an important role in that future, alongside other authentication and verification mechanisms designed to address varying risk, assurance, and regulatory requirements.