How Passkeys Work in Safari on macOS 13

Passkeys are a modern, passwordless authentication standard designed to replace traditional passwords with cryptographic key pairs, eliminating vulnerabilities like phishing and credential leaks. Introduced natively in macOS 13 Ventura, passkeys integrate directly into Safari, allowing users to create accounts and sign in securely using biometric authentication like Touch ID without ever typing or remembering a password.

What Are Passkeys?

Passkeys are built on the WebAuthentication (WebAuthn) and FIDO Alliance standards. Instead of relying on a shared secret—such as a password stored on both your device and a company's server—a passkey relies on public-key cryptography.

When you generate a passkey, two unique keys are created:

  • The Public Key: Stored on the website or service’s server. It is useless to attackers on its own and does not compromise your account if the server suffers a data breach.
  • The Private Key: Stored securely and exclusively on your local device. It is never transmitted across the internet or shared with the website.

Because the private key stays on your device and is only activated for the exact domain it was created for, passkeys are entirely immune to phishing attacks, fake login portals, and credential stuffing.

How Passkeys Work in Safari on macOS 13

In macOS 13 Ventura, Safari natively manages passkeys through the operating system's security architecture and iCloud Keychain.

1. Creating a Passkey

When registering for a supported website or app in Safari:

  1. The website asks if you want to save a passkey.
  2. Safari prompts you to verify your identity using Touch ID (or your Mac login password if Touch ID is unavailable).
  3. The Mac creates the cryptographic key pair, sends the public key to the server, and securely saves the private key.

2. Signing In

When returning to a site to log in:

  1. Safari automatically detects that you have a saved passkey for the domain and presents your account name.
  2. You confirm the sign-in with Touch ID.
  3. Your Mac signs a cryptographic challenge provided by the server using your private key and returns the signature to verify your identity. The entire process takes seconds and requires no manual input.

3. Synchronization via iCloud Keychain

Passkeys generated in Safari on macOS 13 are automatically synced across your Apple devices using iCloud Keychain. This ensures that a passkey created on your Mac is instantly accessible in Safari on your iPhone (running iOS 16 or later) and iPad (running iPadOS 16 or later). iCloud Keychain protects these keys with end-to-end encryption, meaning Apple cannot read or access them.

4. Cross-Platform Authentication

If you need to sign in to a passkey-enabled website on a non-Apple device (such as a Windows PC running Google Chrome), macOS 13 passkeys still function. The non-Apple browser displays a QR code, which you scan using your iPhone or iPad camera. Bluetooth proximity verification confirms that your device is physically close to the computer, allowing you to authenticate the login securely using Touch ID or Face ID.