Passkeys

Play this lesson

Passwords at scale

With thousands of players, some will reuse a password that leaked from another site. Course 1 explained passkeys. This lesson is about moving a whole game's players onto them.

What a passkey is

The FIDO Alliance, which writes the standard, says passkeys "replace passwords with cryptographic key pairs". A passkey is "a secret stored on one's devices, unlocked by the user the same way they unlock their device".

The server keeps only the public half of the pair, which can check a sign-in but never make one.

Quick check

Priya imagines attackers stealing Shard Garden's sign-in database. With passkeys, what would they get?

  1. Public keys, which can't sign anyone in
  2. Every player's password
  3. Every player's fingerprint
Show the answer

Public keys, which can't sign anyone in

The secret half stays on players' devices. A fingerprint only unlocks a player's own device, so it is never sent anywhere.

Tied to one site

Passkeys "are tied to a user's account on a website or application." A fake page that looks like Shard Garden's sign-in gets nothing, because the passkey only works for the real site.

Synced or bound

"Passkeys can be securely synced across a user's devices, or bound to a particular device (device-bound passkeys)."

A synced passkey survives a lost phone: the laptop still has it. A device-bound passkey is lost with its device.

Pick the passkey

A player uses a phone and the family laptop, and often loses phones. Which passkey suits them?

  1. A synced passkey
  2. A device-bound passkey on the phone only
  3. No passkey, just a password
Show the answer

A synced passkey

A synced passkey is on both devices, so losing the phone doesn't lock the player out.

Rolling them out

Remy offers players a passkey right after a successful sign-in, when the player has just proved who they are. The old way keeps working until most players have switched.

Then the weakest point is account recovery. If an email link can reset the account, an attacker who gets into that email skips the passkey.

Quick check

Once a player has a passkey, how their account is recovered no longer matters for security.

Show the answer

False

Recovery is a second way in. It must be as hard to fake as the passkey, or attackers simply use it instead.

After the sign-in

Once a player is signed in, every request still has to prove who it comes from.

Bolt says: Next: tokens and sessions.

Fact-checked 12 October 2026