Ahmadreza Samadi / HomeWait, That’s Tech? · Everyday technology
How passkeys work: why Face ID is not your password
Face ID can approve a passkey sign-in, but your face is not the credential that the website checks. Your device proves that it can use a private key.
At a glance
Passkeys protect the sign-in path, but they do not make every message, recovery process or compromised device safe. Some sync through a provider; others stay on a device or security key, so check how yours is stored and recovered.
What does the website receive?
When you register a passkey, a public key is associated with your account. During sign-in, the service sends a fresh challenge. Your authenticator signs it with the corresponding private key, and the service checks the signature using the public key. The website does not receive your face scan or the private key.
What does Face ID do?
Face ID, a fingerprint, or a device PIN can authorize local use of the credential. The familiar unlock gesture is the approval step; the cryptographic exchange is the sign-in. Which method appears depends on your device and passkey provider.
Why does this help against phishing?
WebAuthn credentials are scoped to a relying party. The browser and authenticator enforce the relevant website identity, so a lookalike login page cannot simply ask you to type the same reusable secret. This protects the sign-in path; it does not make every message, recovery process, or compromised device safe.
What if I lose my phone?
Some passkeys sync through a provider; others stay on a device or security key. Recovery therefore depends on how your passkey was created and stored. Check your provider's recovery options before relying on a single device.
The product lesson
A useful sign-in explanation should distinguish the gesture from the proof. In my visual explainer, the key moment is the handoff: the website gets a signature it can verify. That is easier to understand than treating a face scan as a password.
Watch the original explainer
This article accompanies my published visual explainer. The social posts are in English.
Watch on Instagram · @ahmadreza_smdi · Watch on YouTube · Read the LinkedIn post