What is the difference between an authenticator app and a passkey?
Short answer
An authenticator app provides a second verification factor alongside a password, as outlined by CISA. In contrast, passkeys provide passwordless authentication based on FIDO Alliance guidance. Authenticator app codes can be phished if a user enters them on a fraudulent site, whereas passkeys are designed to be phishing-resistant.
The details
Authenticator apps provide application-based multi-factor authentication by combining something you have with something you know. You enter a traditional password first, then provide a verification code from your device. This requirement stops attackers who possess only your password. However, malicious actors who harvest credentials through deceptive websites can still trick users into submitting both their password and the temporary code.
Passkeys eliminate passwords entirely by using passwordless authentication specifications from the FIDO Alliance. When you register a passkey, authentication relies on cryptographic keys linked to the service rather than shared secrets. To sign in, you confirm your identity locally on your device with a fingerprint, face scan, or PIN. Because authentication is bound directly to the verified website domain, passkeys cannot be submitted to phishing pages.
What to do
- Check whether your online accounts offer passkey options in their security settings.
- Create a passkey on your device for each supported service.
- Keep an authenticator app active as a backup method when passkeys are unavailable.
- Protect the device holding your passkeys with a secure PIN or biometric lock.
Useful next reads and tools
Terms explained
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
- Passkey
- A passkey is a phishing-resistant sign-in credential based on public-key cryptography, stored on a device or in a password manager and unlocked with a biometric or device PIN.
- Phishing
- Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.