Reference on passkeys.dev

Android

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

(create and use passkeys from another device)

Overview

The platform authenticator in Android 9+ has the following capabilities:

iOS & iPadOS

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

(create and use passkeys from another device)

Overview

The default platform authenticator in iOS 16+ and iPadOS 16+, Apple Passwords, has the following capabilities:

Chrome OS

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

(create and use passkeys from another device)

Overview

Creation of passkeys in Chrome OS is not currently supported.

macOS

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

(create and use passkeys from another device)

Overview

The platform authenticator in macOS Ventura (13) has the following capabilities:

Windows

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

(create and use passkeys from another device)

Overview

Windows Hello, the local platform authenticator in Windows 10 and 11, has the following capabilities:

Known Issues

Sat, 03 Sep 2022 16:09:38 +0000

User Verification

The following list of passkey providers have not implemented User Verification in a spec-compliant manner.

Provider	Architecture	`uv`=`required`	`uv`=`preferred`
1Password	Extension	❌ Handles request without performing UV, sets UV true	❌ Sets UV true without performing UV
1Password	Native	✅ Performs UV	✅ UV flag accurate
Bitwarden	Extension	❌ Handles request without performing UV, sets UV true	❌ Sets UV true without performing UV
KeepassXC	Extension	❌ Handles request without performing UV, sets UV true	❌ Sets UV true without performing UV
Okta Personal	Extension	❌ Handles request without performing UV, sets UV true	❌ Sets UV true without performing UV
Okta Personal	Native	✅ Performs UV	✅ UV flag accurate
Proton Pass	Extension	❌ Handles request without performing UV, sets UV true	❌ Sets UV true without performing UV
Proton Pass	Native	❌ Handles request without performing UV, sets UV true	❌ Sets UV true without performing UV
Strongbox	Native	❌ Handles request without performing UV, sets UV true	❌ Sets UV true without performing UV

Architecture: Extension = web browser extension, Native = OS native app using provider APIs

Specifications

Thu, 04 Aug 2022 17:33:14 +0000

The two primary technical specifications that work together to enable passkeys are Web Authentication, commonly referred to as WebAuthn, and the Client to Authenticator Protocol (CTAP), commonly referred to as FIDO2.

The two specs together are often referred to as one stack, FIDO2/WebAuthn.

W3C Web Authentication (WebAuthn)

WebAuthn is the primary specification used by developers.

Platforms also create their own platform-specific abstractions of the WebAuthn API for use by native apps.

Terms

Thu, 12 Nov 2020 13:26:54 +0100

2FA user

A user whose account has 2FA turned on, i.e., who must present 2 authentication factors during sign-in.

2-Factor Authentication (2FA)

also sometimes referred to as MFA: multi-factor authentication or 2SV: two-step verification

This refers to a contract between a user and a Relying Party (RP) where the RP must collect at least two distinct authentication factors from the user during a bootstrap sign-in.