How Touch ID and Face ID Authenticate Passkeys in iOS 16

Passkeys in iOS 16 replace traditional passwords with cryptographic key pairs to enhance account security and streamline the sign-in experience. This article explains the technical mechanics of how Apple utilizes biometric verification—specifically Touch ID and Face ID—to unlock and authorize passkeys, ensuring that sensitive credentials never leave your device while remaining completely immune to phishing attacks.

The Foundation: Public-Key Cryptography

Passkeys are built on the FIDO Alliance and W3C WebAuthn standards, which rely on asymmetric cryptography. When an account is created using a passkey, the system generates two separate keys:

  • Public Key: Sent to and stored on the website or app server.
  • Private Key: Generated and retained exclusively on your Apple device.

To log in, the server issues a unique cryptographic challenge. The user’s device must sign this challenge using the private key and return the signature to the server. If the signature matches the public key on file, access is granted.

The Role of the Secure Enclave

In iOS 16, the private key is not stored in standard system memory or software storage. Instead, it is protected by the Secure Enclave, an isolated hardware-based coprocessor dedicated to handling cryptographic operations and biometric data.

The private key is bound to a strict access control policy within the hardware. It cannot be copied, exported, or used to sign challenges until a specific condition is met: the local authentication of the device owner.

How Biometrics Unlock the Private Key

Touch ID and Face ID serve as the local gatekeepers for passkey operations. Crucially, your biometric data is never transmitted to the website, app, or external servers. The authentication process functions entirely on the local device through the following steps:

  1. Authentication Request: When you tap to log in on a supported service, Safari or an iOS app detects the passkey requirement and requests authentication from the operating system.
  2. Biometric Prompt: iOS activates Face ID or Touch ID, prompting you to scan your face or fingerprint.
  3. Hardware Matching: The biometric sensor captures your data and sends it directly to the Secure Enclave, where it is matched against the enrolled template stored inside the hardware.
  4. Authorizing Key Access: Once the Secure Enclave verifies a successful biometric match, it temporarily unlocks access to the designated private key.
  5. Cryptographic Signing: The Secure Enclave uses the private key to sign the challenge provided by the server. Only the completed signature—never the key itself or the biometric data—is released to the operating system.
  6. Server Verification: The app or browser forwards the signature back to the server. The server verifies it against the stored public key, confirming your identity and completing the sign-in.

Cross-Device Syncing via iCloud Keychain

While the biometric authentication happens locally, iOS 16 synchronizes passkeys across your Apple devices using iCloud Keychain. Passkeys are synced using end-to-end encryption, meaning Apple cannot read or access the keys. When a passkey syncs to a secondary device, such as a Mac or iPad, it is protected by that specific device's Secure Enclave, requiring that device's native Touch ID, Face ID, or passcode to authorize access.