Use iOS 16 Passkeys on Non-Apple Devices with QR Codes

Passkeys stored on an iPhone running iOS 16 can be used to sign in to websites and applications on non-Apple devices, such as Windows PCs, Linux machines, Android devices, and Chromebooks. Through the FIDO Alliance standard for cross-device authentication, users can display a QR code on a non-Apple device and scan it with an iPhone to securely authorize the login using Face ID or Touch ID without ever exposing their private credentials.

How Cross-Device Passkey Login Works

Cross-device authentication relies on the FIDO WebAuthn "hybrid" transport mechanism. This protocol allows your iPhone to act as an external hardware security key for any nearby device.

  1. Initiate Sign-In: On the non-Apple device's web browser (such as Google Chrome, Microsoft Edge, or Firefox), select the option to sign in with a passkey.
  2. Choose Another Device: If the browser does not detect a native passkey on the system, select the option to use a phone, tablet, or external security key.
  3. Display the QR Code: The non-Apple device generates a dynamic QR code on the screen.
  4. Scan with iOS 16: Open the native Camera app on your iPhone running iOS 16 and point it at the QR code. Tap the yellow pop-up badge labeled "Sign in with a passkey."
  5. Verify Proximity via Bluetooth: The two devices establish a short-range, encrypted link via Bluetooth to verify that the iPhone is physically close to the computer.
  6. Biometric Authentication: Confirm the sign-in on your iPhone using Face ID or Touch ID. Once verified, the non-Apple browser instantly logs you in.

System Requirements

To use an iOS 16 passkey on an external platform, make sure both devices meet the following criteria:

  • iOS Device: An iPhone or iPad running iOS 16 or later with Bluetooth enabled.
  • Non-Apple Device: An operating system (Windows 10/11, macOS, ChromeOS, or Linux) running a modern web browser that supports WebAuthn/FIDO2.
  • Bluetooth Enabled: Both devices must have Bluetooth turned on. They do not need to be actively paired, but Bluetooth must be active to confirm physical proximity.

Security Advantages

  • End-to-End Encryption: The private cryptographic key stored in your iOS iCloud Keychain never leaves your iPhone. The iPhone merely signs a cryptographic challenge sent by the relying site.
  • Phishing Resistance: Because the exchange requires both domain verification and physical Bluetooth proximity, remote attackers cannot trick you into scanning a QR code over the internet to hijack your session.