No system is infallible, but the passwords people currently use are one of the biggest security problems with the web. “This means the server can be sure that you have the right private key, without knowing what the private key actually is,” Davidson said. This answer is then validated by the public key, which then allows you to log in. The private key, which is stored on your device, is able to answer this challenge and send its response back. When you try to sign in to one of your accounts using a passkey, the website or app’s server sends your device a “challenge,” essentially asking your device to prove that it’s you logging in. “The server never learns what your private key is, and your devices keep it safe,” Davidson said. One of these keys is public and stored on Apple’s servers, while the other key is a secret key and stays on your device at all times. “These keys are generated by your devices, securely and uniquely, for every account,” Garrett Davidson, an engineer on Apple’s authentication experience team, said in a video about passkeys. When you create a passkey, a pair of related digital keys are created by your system. As a result, a passkey isn’t something that can (easily) be typed. The passkeys themselves use public key cryptography to protect your accounts. Under the hood, Apple’s passkeys are based on the Web Authentication API (WebAuthn), which was developed by the FIDO Alliance and World Wide Web Consortium (WC3).

Dashlane macos app