Apple passkeys make logging into websites and apps more secure by using strong cryptographic public/private key pairs.
But what are passkeys, how do passkeys work and why are they more secure than using passwords?
What Are Apple Passkeys?
Apple Passkeys are an alternative to using passwords to log into your favorite apps and websites.
Passkeys use asymmetric encryption to help secure your login credentials in a more secure way than passwords… This makes passkeys less vulnerable to phishing, the most common form of hacking.
Instead of using a password, which is a shared credential between you and the website or app you are logging into, your iPhone generates a unique, secure key pair between it and the app or website you are logging into.
The result is that for each website or app, you will have a unique cryptographically strong key pair comprised of a public key and a private key that must be used together to provide access to your account.
How Do Passkeys Work?
In authentication, there are three common ways that you will be asked to identify yourself:
- Something you know (i.e. your password)
- Something you have (i.e. a physical hardware key or code from an authentication device)
- Something you are (i.e. your fingerprint, your face, etc.)
When logging into websites, for the longest time we have been trained to verify our identities by sharing “something you know”, such as a password or PIN…
However, this is only one of the three methods of authentication, and it is the least secure. Passwords and PINs can be hacked, guessed, reused, or we can be tricked into divulging them in a phishing attack…
As such, using “something you have” or “something you are” adds a layer of additional security for any of your online accounts.
Passkeys work by leveraging the physical aspect of the latter two authentication and identity validation factors:
- Something you have: Access to your iPhone, iOS device, Mac, or a separate hardware key (such as a YubiKey), etc.
- Something you are: Biometrics such as your retina, face or fingerprint, etc.
When using a website or app that supports passkeys, you simply choose the “create passkey” option and your iPhone or other Apple device will generate a unique “public-private key pair” associated with the specific user account. This will require your authentication process to rely on a physical device and/or biometrics.
The public-private key pair is comprised of two keys:
- Public Key: Which is stored on the server associated with the app or website
- Private Key: Which is stored on your device, and encrypted in your iPhone’s secure enclave. The private key is never transmitted over the Internet. It is synced to iCloud Keychain for use on all your Appel devices.
To authenticate, when used with an Apple device that uses Face ID or Touch ID, passkeys can use these second factor, local methods of authentication.
Are Passkeys More Secure Than Passwords?
Passkeys are indeed safer and more secure than passwords for a few reasons:
- No Need to Remember Passkeys: Passkeys make it impossible to reuse common or weak passwords because they eliminate the need for users to remember or type passwords entirely… This reduces vulnerabilities, laziness, errors and login times. Authentication can be enhanced locally through Face ID or Touch ID biometrics or device PINs, making it easier for users while enhancing security.
Phishing Countermeasure: Passkeys are designed to be phish-proof, or close to it. When a user attempts to log in, the passkey is bound to the original website, meaning it cannot be used on malicious sites. If a user encounters a phishing site, their passkey will not be prompted, preventing theft. And, since you do not “know” the passkey, you can’t be tricked into revealing it.
- Passkeys Can’t Be Compromised In A Breach: The nature of asymmetric encryption means the public key and the private key are different and the private key never leaves the user’s device. This means that even if a server is compromised, a public key could be exposed and attackers still cannot access the private key, significantly reducing the risk of credential theft.
Basically, passkeys significantly enhance security compared to traditional passwords, addressing many vulnerabilities inherent in password-based systems.
Like passwords, passkeys are encrypted and stored in your Apple Passwords app, as well as synced to your iCloud Keychain in encrypted format, where they aren’t visible to anyone (including Apple)
How To Enable Passkeys On iPhone
To turn on passkeys, iCloud Keychain and two-factor authentication must be turned on.
Just go to settings > general > autofill & passwords and toggle the option for “autofill passwords and passkeys”.
Once this is set up, you can create passkeys with any business that supports them.1 Then, any passkeys you create on your iPhone should be automatically stored in your Apple Passwords app and synced to iCloud keychain…
Summary
Passkeys are an alternative to passwords that provide you with a more secure system than the traditional method of using “something you know”.
Passkeys are made more secure by using “something you are” and “something you have”, specifically your biometrics and your hardware device… This eliminates common vulnerabilities associated with password management – such as password fatigue – and enhances your login experience through a more seamless authentication method.
The implementation of Apple passkeys represents a significant advancement in digital security practices for Apple users.
Footnotes
- For a list of businesses that support passkeys, visit the FIDO Alliance website.
