Passkeys: should I add them to my app's login?
asked a month ago657 viewsen
Passkeys seem to be everywhere now (Google, GitHub, banks). Is it worth implementing them for my app, and how hard is it?
AI diagnosis
AI-generated. Not an answer — the community below confirms or corrects it. Always verify before relying on it.
1 Answer
For most apps with user accounts, yes. Passkeys (WebAuthn/FIDO2) are phishing-resistant: the credential is bound to your domain, so a fake login page can't use it. There's no password to reuse, leak or brute-force, and login is faster (fingerprint or face unlock).
How it works: the device creates a key pair and your server stores only the public key. At login, the device signs a server challenge with the private key, which never leaves the device (it's synced via iCloud Keychain or Google Password Manager).
Implementation: - Don't hand-roll WebAuthn. Use SimpleWebAuthn (JS/TS), py_webauthn, webauthn4j, or your auth provider's built-in support (Auth.js, Clerk, Auth0, Supabase…). - Offer passkeys alongside existing login at first ("Add a passkey" in settings, then offer it after password login). - Keep a solid account recovery path (email plus a second factor). Recovery is where passkey rollouts are usually weakest.
Support is broad across modern iOS, Android, Windows and macOS, but keep a fallback for users on older devices.
Sign in to tell others whether this worked.
Sign in and verify your email to post an answer.