What passkeys are, how they work, and why Passkallet uses them.
Overview
What is a Passkey?
A passkey is a modern replacement for passwords. Instead of typing a secret string, you use your body -- a fingerprint, your face, or a hardware key -- to prove who you are.
Why Passkeys Instead of Private Keys?
| Problem | Private Keys | Passkeys |
|---|---|---|
| Can be phished | Yes (if typed on a fake site) | No (bound to real domain) |
| Can be stolen | Yes (if stored insecurely) | No (never leaves the device) |
| Can be lost | Yes (and funds are lost forever) | Recoverable (sync across devices) |
| User experience | Terrible (copy-paste hex strings) | Great (just use your fingerprint) |
How Passkallet Uses Passkeys
1. User wants to approve a transaction
2. Passkallet sends a challenge to the user's browser
3. Browser asks user for biometric (fingerprint/face)
4. Device signs the challenge with the private key
5. Passkallet verifies the signature
6. Transaction is approved and submittedThe user never sees a private key, a seed phrase, or any cryptographic material. Passkallet uses the P-256 (secp256r1) curve, which is the standard for WebAuthn passkeys.
Supported Authenticators
| Platform | Authenticator |
|---|---|
| iOS / macOS | Face ID, Touch ID |
| Android | Fingerprint, Face Unlock |
| Windows | Windows Hello (fingerprint, face, PIN) |
| Cross-platform | Security keys (YubiKey, etc.) |
Passkey Sync
- Apple: Synced via iCloud Keychain (iPhone, iPad, Mac)
- Google: Synced via Google Password Manager (Android, Chrome)
- Microsoft: Synced via Microsoft account (Windows devices)
Passkeys require a compatible browser. All modern browsers (Chrome 109+, Safari 16+, Firefox 122+, Edge 109+) support them. Passkeys are domain-bound -- see Domain Passkeys.