Reference on passkeys.dev

Android

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

iOS & iPadOS

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

Chrome OS

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

macOS

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

Windows

Sat, 03 Sep 2022 16:09:38 +0000

Local Authenticator

(create and use passkeys from the local device)

External Authenticator

Known Issues

Sat, 03 Sep 2022 16:09:38 +0000

Passkey Metadata

Samsung Pass

According to Samsung documentation ( source), Samsung Pass creates synced passkeys which are available on other devices where Samsung Pass is installed.

During testing on 2024-09-05, it was observed that passkeys created in Samsung Pass return the backup eligible flag as false, signaling a device-bound passkey.

Specifications

Thu, 04 Aug 2022 17:33:14 +0000

The two primary technical specifications that work together to enable passkeys are Web Authentication, commonly referred to as WebAuthn, and the Client to Authenticator Protocol (CTAP), commonly referred to as FIDO2.

The two specs together are often referred to as one stack, FIDO2/WebAuthn.

W3C Web Authentication (WebAuthn)

WebAuthn is the primary specification used by developers.

Platforms also create their own platform-specific abstractions of the WebAuthn API for use by native apps.

Terms

Thu, 12 Nov 2020 13:26:54 +0100

2FA user

A user whose account has 2FA turned on, i.e., who must present 2 authentication factors during sign-in.

2-Factor Authentication (2FA)

also sometimes referred to as MFA: multi-factor authentication or 2SV: two-step verification

This refers to a contract between a user and a Relying Party (RP) where the RP must collect at least two distinct authentication factors from the user during a bootstrap sign-in.