What is a passkey?
The word has two meanings in IT, and a technician runs into both:
- Sign-in passkey: a passwordless credential for websites and apps, built on the FIDO2 and WebAuthn standards.
- Bluetooth passkey: the numeric code used to pair two Bluetooth devices.
Passkeys for passwordless sign-in
When you create a passkey for a site, your device generates a public/private key pair just for that site. The site stores only the public key. The private key stays on your device, in a password manager, or on a hardware security key. To sign in, the site sends a challenge, you unlock the passkey with a fingerprint, face scan or PIN, and the device signs the challenge with the private key. The fingerprint, face data or PIN never leaves the device.
- Phishing-resistant: a passkey is bound to the site's real domain, so the browser won't offer it to a look-alike site.
- Nothing useful to steal from the server: a breach exposes only public keys, which can't be used to sign in.
- Nothing to reuse or guess: every site gets its own key pair.
Passkeys can sync across a user's devices through a password manager or platform account, or stay bound to one hardware security key. Windows Hello can store and unlock passkeys on a Windows PC. To sign in on a computer with a passkey stored on a phone, the computer shows a QR code; the phone scans it and uses Bluetooth to confirm the two devices are near each other.
Passkeys in Bluetooth pairing
Bluetooth pairing uses a code to prove that the two devices being paired are the ones in front of the user. Secure Simple Pairing, introduced in Bluetooth 2.1, offers several methods:
| Method | What the user does | Typical devices |
|---|---|---|
| Numeric comparison | Both screens show the same six-digit code; confirm they match | Phone to PC, phone to car |
| Passkey entry | One device shows a six-digit passkey; type it on the other | Keyboard to PC |
| Just Works | Nothing; the pairing is accepted with no code | Headsets and speakers without a screen |
| Legacy PIN | Enter a fixed PIN, often 0000 or 1234 | Accessories older than Bluetooth 2.1 |
Numeric comparison and passkey entry protect against eavesdropping and on-path (man-in-the-middle) attacks. Just Works encrypts the link but can't stop an on-path attacker, and a fixed legacy PIN offers little protection.
Pairing steps a tech walks through
- Turn on Bluetooth at both ends.
- Put the accessory in pairing (discoverable) mode, usually by holding its power or pairing button.
- On the phone or computer, select the accessory from the list of devices it finds.
- Confirm the matching code, type the passkey or enter the PIN, depending on the method.
- Test it: play audio, type a few keys or move the mouse.
For the CompTIA A+ exams
Core 1 (220-1201) objective 1.3 covers Bluetooth pairing on mobile devices: turning Bluetooth on, putting devices into pairing mode, locating the device, entering its PIN code and testing the link. Expect questions where a device won't pair until it's in pairing mode or the right code is entered. The sign-in kind of passkey isn't named in the Core 1 objectives. It ties to the authentication topics in Core 2 (220-1202), such as multifactor authentication, because a passkey combines something you have (the device) with something you are or know (a biometric or PIN).