Sei interessato ai nostri servizi di consulenza?

1 Clicca nella sezione contatti
2 Compila il form
3 Ti ricontattiamo

Se hai bisogno urgente del nostro intervento puoi contattarci al numero 370 148 9430

RENOR & Partners

I nostri orari
Lun-Ven 9:00AM - 18:PM
May 9, 2025

Goodbye passwords? 2025 is the year of passkeys.

Goodbye passwords? 2025 is the year of passkeys.

by Simone Renzi / May 9, 2025
Post Image

This post is also available in: Italiano (Italian)

Have you ever opened a website, tapped the “email” field, and found yourself already authenticated thanks to your iPhone’s Face ID or fingerprint, without typing a single letter?

Behind that gesture—imperceptible yet revolutionary—there is a passkey: a pair of cryptographic keys, securely stored on your device, that permanently retires the use of passwords.

Why the year of passkeys?

This is far from just a catchy headline. As of May 2025, 90.93% of devices globally are capable of passkey-based authentication. 74% of consumers with a passkey-ready device are aware of this technology. Of these, 69% have already enabled it, and 50% of the world’s top 100 websites have integrated it into their systems.

We can therefore confidently state that 2024 was the pilot year, while 2025 is the year of mass adoption, with figures now surpassing those of any previous login technology.

How does the passkey work?

I’ll explain it to you in three key concepts:

  1. Key pair – One public key that is stored on the server, and one private key that never leaves your device.
  2. FIDO2 and WebAuthn – These are two open standards, already supported by all modern browsers.
  3. Biometrics as unlock, not as credentials – It’s your face that unlocks the private key, without that key ever “travelling around” the network.

Key pair – The double-lock mechanism

We mentioned that one of the key elements of the passkey system is a key pair (public and private).

The public key is like the address of your mailbox: anyone can know it and use it to “drop in” a letter. This key is saved in the service’s database when you register.

The private key is the key that physically opens the mailbox, and it always stays in your pocket (in the phone’s chip or your browser). It never leaves your pocket/device.

How does the login work?

The server sends a random challenge, the device signs the challenge with the private key. The server then verifies the signature using the public key it already has.

If the signature is valid, you’re authenticated—without any password ever crossing the network.

Why is this a more secure system?

Because a hacker who gains access to the database can only obtain public keys, which are useless without the corresponding private key.

FIDO2 + WebAuthn: the standard that bridges hardware and the web

To understand why passkeys work everywhere without the user needing to install anything, it’s enough to see how FIDO2 has united two worlds that previously didn’t communicate: the Web and the world of security hardware.

Imagine a charter of laws that establishes general rules. The core principles are passwordless authentication, anti-phishing protection, and interoperability across devices. Under these laws, two components coexist:

WebAuthn

It’s an official W3C JavaScript API already built into Chrome, Safari, Firefox, Edge, and other minor browsers. From the developer’s point of view, it’s the only interface needed, called:
WebAuthn

navigator.credentials.create()

to register the passkey and

navigator.credentials.get()

to use it.

 

Everything else—key pair generation, Face ID/Touch ID display and usage, signing the challenge—happens behind the scenes.

CTAP2

Once the browser receives the request via WebAuthn, it needs to communicate with the hardware that holds the private key: this could be the Secure Enclave chip on an iPhone, the TPM on a Windows laptop, a YubiKey USB-C, or an NFC security key.
The language used for this communication is CTAP2 (Client To Authenticator Protocol 2), defined by the FIDO Alliance.
This way, the authenticator is free to evolve—today it might be a fingerprint, tomorrow it could be a retinal scan—without requiring websites to change their code.

Why is this dual layer important?

Because it ensures that the same backend integrating WebAuthn will seamlessly communicate with either an Android phone or a hardware key, since the CTAP2 layer is abstracted.
It’s important because it provides anti-phishing security: the private key is bound to the domain for which it was created; if a fake site tries to deceive the browser, CTAP2 refuses to sign the challenge.
It also enables graceful compatibility—if a device doesn’t natively support a compatible authenticator, the browser can fall back to traditional authentication methods (e.g., password and OTP) without breaking the user experience.

In essence, FIDO2 is the bridge, WebAuthn is the developer’s lane, and CTAP2 is the expressway reserved for security chips. Thanks to this layered architecture, we can enable passkeys with just a few lines of code and be confident that they will continue to work as new devices emerge that may implement other forms of biometrics.

Where are we already using Passkey technology?

Since iOS 18, Apple has integrated the “Passwords” app, which centralizes both passwords and passkeys; Touch ID or Face ID are used to unlock them.

With Windows Hello on Windows 11, you can create and use passkeys on Edge, Chrome, and Firefox without installing anything.

In Android 15, the Credential Manager API enables “single-tap sign-in” across passkeys, Google Sign-In, and traditional passwords.

For the user, it’s the phone that logs in on its own; for the security team, it’s a farewell to phishing.

 

Advantages only for security?

The advantages aren’t limited to security—they also include speed. Google has measured login times cut in half compared to entering a username and password. Moreover, there’s no need to remember any password, since passkeys are password-free.

Simone Renzi
Seguimi
Latest posts by Simone Renzi (see all)

Scegli un'area

Accesso Utenti
Accesso Rete Vendita

CONTATTACI

Ti risponderemo entro 24 ore

TORNA SU