Passkeys are a password replacement technology based on the FIDO2/WebAuthn standard that use public-key cryptography to authenticate users without transmitting any secret over the network. Instead of typing a password that can be phished, leaked, or brute-forced, users authenticate using their device’s biometrics (fingerprint, face recognition), PIN, or security key. Google, Apple, and Microsoft have all implemented passkey support across their platforms, and as of 2026, over 15 billion accounts worldwide support passkey login. For Indian developers and businesses, passkeys solve the persistent problems of password fatigue, credential stuffing attacks, and the difficulty of implementing secure authentication in a market where users commonly reuse passwords across services.
Last updated October 2026
What Are Passkeys and How Do They Work?
A passkey is a cryptographic key pair — a private key stored securely on the user’s device (in the TPM, Secure Enclave, or Android Keystore) and a public key stored on the website’s server. During authentication:
- The server sends a challenge (random bytes)
- The user’s device signs the challenge with the private key after biometric verification
- The server verifies the signature with the stored public key
- Authentication succeeds without any password being transmitted
Why this is more secure:
- No shared secret: The private key never leaves the device. There’s nothing for phishers to steal or for databases to leak.
- Phishing-resistant: Passkeys are bound to the specific website domain. A passkey created for yourbank.com will not work on y0urbank.com (a phishing site).
- No reuse vulnerability: Each passkey is unique to a single site. Compromising one service doesn’t affect others.
- Replay-proof: Each authentication uses a unique challenge, so captured authentication data cannot be replayed.
How Are Passkeys Different from Passwords and OTPs?
| Factor | Password | OTP (SMS/Email) | Passkey |
|---|---|---|---|
| Phishing risk | High | Medium (SIM swap, interception) | None (domain-bound) |
| Credential stuffing | High (reuse) | N/A | None (unique per site) |
| Database leak risk | High | Low | None (only public key on server) |
| User experience | Poor (remember, type, reset) | Moderate (wait for code, switch apps) | Excellent (biometric, 2 seconds) |
| Cost | Free | ₹0.15–₹0.50 per SMS | Free |
For Indian businesses currently spending ₹0.15–₹0.50 per SMS OTP, passkeys offer a superior authentication experience at zero per-authentication cost.
How to Implement Passkeys in Your Web Application
Step 1: Understand the WebAuthn API
Passkeys use the W3C Web Authentication API (WebAuthn), which is supported by all major browsers. The two core operations are:
navigator.credentials.create()— Registration: creates a new passkey for this websitenavigator.credentials.get()— Authentication: uses an existing passkey to sign in
Step 2: Choose a Server-Side Library
You do not need to implement the WebAuthn cryptography from scratch. Libraries are available for every major backend:
- Node.js: @simplewebauthn/server
- Python: py_webauthn
- PHP: web-auth/webauthn-lib
- Java: java-webauthn-server (Yubico)
- .NET: Fido2NetLib
Step 3: Implement Registration Flow
- Server generates registration options (challenge, RP ID, user info)
- Client calls
navigator.credentials.create()with these options - Browser/OS prompts user for biometric verification
- Client sends the attestation response to server
- Server verifies and stores the public key associated with the user
Step 4: Implement Authentication Flow
- Server generates authentication options (challenge, allowed credential IDs)
- Client calls
navigator.credentials.get() - Browser/OS prompts user for biometric verification
- Client sends the assertion response to server
- Server verifies the signature and logs the user in
Step 5: Handle Cross-Device Authentication
Passkeys sync across devices through platform credential managers — iCloud Keychain for Apple, Google Password Manager for Android/Chrome, Windows Hello for Microsoft. Users who create a passkey on their Android phone can use it on their Chromebook or another Android device automatically.
For cross-ecosystem login (e.g., passkey on iPhone, signing in on Windows laptop), the FIDO2 “hybrid transport” allows scanning a QR code on the computer with the phone, establishing a BLE proximity-verified connection.
What Challenges Do Indian Developers Face with Passkey Adoption?
Device Fragmentation
India has enormous device diversity — from flagship phones with fingerprint sensors to budget devices running Android Go. Not all devices support biometric authentication. Solution: offer passkeys as the primary login method but maintain SMS OTP or email-based fallback for devices that don’t support WebAuthn.
Shared Device Usage
In Indian households, shared smartphones and computers are common. A passkey tied to a shared device allows anyone who can unlock that device to access the account. For sensitive applications (banking, healthcare), consider requiring a device PIN specific to the passkey authentication, separate from the device unlock.
User Education
Most Indian internet users are unfamiliar with passkeys. During rollout: explain the concept in simple terms (“Sign in with your fingerprint instead of a password”), provide a visual guide, and keep password login available during the transition period. Google’s approach — offering passkeys as an option alongside password during login — is a good model.
Which Indian Platforms and Banks Support Passkeys?
As of October 2026:
- Google: Full passkey support for all Google accounts, including Workspace accounts used by Indian businesses
- WhatsApp: Passkey login support on Android and iOS
- Paytm, PhonePe, GPay: Exploring passkey integration for app login (biometric already used for transaction authentication)
- Select banks: Some progressive Indian banks are piloting passkeys for internet banking, though most still rely on the password + OTP model mandated by RBI guidelines
- Government: DigiLocker and Aadhaar-based authentication remain separate systems, but passkey support for government portals is under discussion
Frequently Asked Questions
What happens if I lose my phone with my passkeys?
If you use synced passkeys (the default for Apple, Google, and Microsoft), your passkeys are backed up to the cloud and available on your other devices. Log in from another device using the same account. If you have no other device, use the account’s recovery mechanism (recovery email, recovery phone, backup codes). This is why maintaining a fallback authentication method is important.
Are passkeys suitable for Indian banking applications?
Passkeys provide stronger security than the current password + SMS OTP model used by Indian banks. However, RBI’s cybersecurity framework mandates specific authentication factors, and banks must get regulatory approval before changing their authentication mechanisms. For non-banking financial applications (mutual fund platforms, insurance portals), passkeys can be implemented now. Banks are likely to adopt passkeys within 2–3 years as RBI guidelines evolve.
Can passkeys work offline?
The authentication ceremony (biometric verification and cryptographic signing) happens entirely on the device and works offline. However, the server must verify the signed challenge, which requires network connectivity. For offline scenarios, consider caching an authenticated session token locally (with appropriate security measures) after the initial passkey authentication.
How much does passkey implementation cost?
The WebAuthn API and client libraries are free and open source. Server-side implementation using libraries like SimpleWebAuthn requires 2–5 days of developer time for a basic integration. Managed passkey services (Passage by 1Password, Auth0, Firebase Authentication) offer plug-and-play integration starting at $0/month for small scale, scaling with active users. The ongoing cost is zero per authentication — unlike SMS OTP which costs ₹0.15–₹0.50 per message.
Should I remove password login entirely and go passkey-only?
Not yet. In India’s diverse device and connectivity landscape, a passkey-preferred strategy (encourage passkeys, show them as the default option, but maintain password/OTP fallback) is more practical than passkey-only. As device support improves and users become familiar, gradually reduce reliance on passwords. Some early adopters like Shopify have moved to passkey-only for their staff admin access, but consumer-facing Indian applications should maintain fallbacks for the next 2–3 years.
