Innomerc One useful thing to do today
Create passkeys through the real service’s account settings.
More everyday safety lessonsChoose your depth. Learn at your own pace.
Understand it
A passkey lets a supported device or password manager prove it holds your sign-in key. You usually unlock it with your device PIN, face or fingerprint. That local unlock is not a password you send to the website.
Passkeys check which site is asking, helping resist fake login pages. Protect your device and the account that syncs your passkeys. Set up recovery before you lose a device; available backup methods depend on the provider.
Under the hood
WebAuthn binds a signed challenge to a relying party and origin. The server keeps a public key; the private key stays with the authenticator or its protected sync system. User verification and credential backup properties must be evaluated separately.
Practitioner perspective
Review fallback authentication, recovery, enrollment and session handling, not just the passkey prompt. Synced and device-bound credentials have different deployment properties. A valid passkey does not authorize arbitrary application actions or stop an attacker using an already stolen session.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Lookalike page
A different site requests a sign-in.
Read every step without animation
Fake website
- Lookalike page. A different site requests a sign-in.
- Site check. The legitimate site’s passkey does not match.
- No matching proof. That passkey cannot simply be replayed there.
Site binding changes the phishing outcome.
Real website
- Correct site. You open your saved service address.
- Device unlock. You approve the supported passkey prompt.
- Proof checked. The service verifies the signed challenge.
The reusable private key is not sent to the website.
What could go wrong
A copied page asks for a credential belonging to a different website. Origin binding prevents that ordinary cross-site use.
What you can do
- Create passkeys through the real service’s account settings.
- Keep the device locked and review recovery and synced devices.
Common mistakes
- A passkey does not make a fraudulent payment request honest.
- Removing a passkey from one device may not delete every synced copy or server registration.
Check your understanding
Active recall: explain this idea in 30 seconds
A passkey lets a supported device or password manager prove it holds your sign-in key. You usually unlock it with your device PIN, face or fingerprint. That local unlock is not a password you send to the website.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.