# Passkey

> A passkey is a phishing-resistant sign-in credential based on public-key cryptography (FIDO/WebAuthn). How passkeys work, passkey vs OTP, and why phone numbers still matter.

Canonical: https://mobilevalidate.com/glossary/passkey · Last updated: 2026-09-26

![A cell tower sends signal to a SIM card; the line type is identified as mobile rather than landline or VoIP.](https://mobilevalidate.com/images/carrier-and-line-type-lookup.svg)

*Carrier lookup returns the line type (mobile, landline or VoIP) and the network behind the number.*


A passkey is a sign-in credential that replaces passwords and one-time codes with public-key cryptography. The FIDO Alliance defines it as "an authentication credential based on FIDO standards, that can be stored on your phone or computer, or in a hardware security key allowing a user to sign in to apps and websites with the same process that they use to unlock their device" ([FIDO Alliance](https://fidoalliance.org/passkeys/)). Because each passkey only works for the site it was created for, passkeys resist phishing.

## How does a passkey work?

Passkeys are built on the W3C Web Authentication standard, [WebAuthn Level 3](https://www.w3.org/TR/webauthn-3/) (a W3C Recommendation since August 2026), and FIDO's client-to-authenticator protocol.

1. **Registration.** Your device creates a new key pair for the site. The private key stays in the device's secure hardware or in your password manager. The site stores only the public key.
2. **Sign-in.** The site sends a random challenge. After you unlock the device with a fingerprint, face or PIN, the device signs the challenge with the private key, and the site checks the signature with the public key.
3. **Scoping.** WebAuthn binds each credential to the site's identifier: "only that Relying Party, as identified by its RP ID, is able to employ the public key credential". A look-alike domain can't ask for it.

The specification calls a passkey a *discoverable credential*: the device can find it without the site first naming the user, which enables username-less sign-in.

## Synced and device-bound passkeys

FIDO distinguishes **synced passkeys**, copied between a user's devices through a cloud service with end-to-end encryption, from **device-bound passkeys** that "never leave a single device", such as those on hardware security keys. Synced passkeys fix the lost-phone problem but depend on the security of the sync account. NIST's [SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) covers syncable authenticators and says they "SHALL NOT be used at AAL3", its highest assurance level.

## Passkey vs OTP

| | SMS / app OTP | Passkey |
|---|---|---|
| Phishing | A code can be typed into a fake site | Bound to the real domain |
| SIM swap | SMS codes move with the number | Not affected |
| Cost per sign-in | SMS fees for delivered codes | None |
| Works on a new device | Yes, if the number or app is there | Needs sync, or another device nearby |
| Account recovery | Often the recovery method itself | Still needs a recovery path |

See [one-time password (OTP)](/glossary/one-time-password-otp) for how codes work and fail.

## Why does it matter for fraud?

When sign-in becomes phishing-resistant, attackers move to the weaker doors: **account recovery**, **adding a new passkey** from a compromised session, and **changing the phone number or e-mail** on the account. A [SIM swap](/glossary/sim-swap) or a newly added VoIP number on a recovery path can undo the security a passkey adds. That is why recovery and contact-change flows deserve the checks sign-in used to get. See [account takeover via phone number change](/blog/account-takeover-phone-number-change).

## How does MobileValidate fit in?

MobileValidate doesn't issue or verify passkeys. It helps on the paths around them: when a user adds or changes a phone number or e-mail for recovery, check its [line type and carrier](/services/carrier-lookup), whether it has an account on channels you use, and, for major webmail providers, whether the [mailbox exists](/services/email-verification). The [account security](/use-cases/account-security) use case shows when to step up verification.

## Frequently asked questions

### What is the difference between a passkey and an OTP?

An OTP is a code that is sent to you or generated for you and then typed in, so it can be phished or intercepted. A passkey never leaves your device or password manager as a secret: the device signs a challenge for one specific website, so a fake site gets nothing it can reuse.

### Do passkeys replace phone numbers?

They replace SMS codes as a sign-in method, not the phone number itself. Numbers remain a contact channel, a recovery option and a fraud signal, and recovery is where attackers go once sign-in is phishing-resistant.

### What happens if I lose the device with my passkey?

Synced passkeys are restored from the passkey provider's end-to-end encrypted sync to a new device. Device-bound passkeys are not, so services need another recovery path, which is often a verified phone number or e-mail address.