Yes, passkeys work with native mobile and desktop apps, and the NCSC recommends them wherever supported. Built on the FIDO2/WebAuthn standard, a passkey replaces your password with a public/private key pair: the private key stays on your device, the public key sits on the server, and your biometric or device PIN unlocks authentication locally. Nothing sensitive ever travels over the network, which is why passkeys resist phishing by design.
The practical upshot for UK users and product owners:
- Passkeys work in native apps on iOS, Android, and Windows, not just in browsers.
- Phishing resistance is structural, not a setting you configure.
- Recovery planning is non-negotiable: losing all your synced devices without a backup method can lock you out permanently.
Key takeaways
Passkeys are the most phishing-resistant authentication method available today, and they work in native apps on iOS, Android, and Windows via platform credential APIs.
| Point | Details |
|---|---|
| Passkeys work in native apps | iOS, Android, and Windows all provide platform APIs that let native apps create and use passkeys. |
| Recovery planning is critical | Register passkeys on multiple devices and add a hardware key before removing your password fallback. |
| NCSC recommends passkeys | The UK's National Cyber Security Centre endorses passkeys for reducing phishing and credential theft. |
| Developers need domain association | Digital Asset Links (Android) and Associated Domains (iOS) are required for native app passkey flows. |
| Pocketapp can implement passkeys | Pocketapp covers discovery, WebAuthn backend, platform integration, and recovery flows for UK app teams. |
Table of Contents
- What is a passkey and how does authentication actually work?
- Do passkeys work with native mobile and desktop apps?
- What devices and operating systems support passkeys?
- Which apps and services already support passkeys?
- How to set up and use passkeys on iPhone, Android, Windows, and password managers
- Passkeys versus password managers and hardware security keys
- What are the risks and limitations of passkeys?
- Developer checklist for adding passkey support to an app
- Why we favour passkeys for new app projects
- Pocketapp's passkey implementation services
- Sources
- FAQ
What is a passkey and how does authentication actually work?
A passkey is a FIDO2-based digital credential consisting of two mathematically linked keys: a public key stored on the service's server and a private key that never leaves your device. When you sign in, the server sends a cryptographic challenge; your device signs it with the private key; the server verifies the signature using the public key. No password is transmitted, stored, or exposed.
The three-step flow looks like this:
- Server → device: "Prove you are who you say you are" (a unique challenge string).
- Device: your biometric or PIN unlocks the private key, which signs the challenge.
- Device → server: the signed response is verified against the stored public key.
Your fingerprint or face scan never leaves the device. It simply unlocks the private key locally, which is a fundamentally different model from password-based multi-factor authentication, where a shared secret must reach the server. The NCSC's passkeys guidance highlights this distinction as the core reason passkeys reduce both credential phishing and server-side exposure.
The FIDO Alliance's FIDO2 and WebAuthn specifications define the interoperability rules that make this work across platforms and vendors. Any service or app implementing these specs correctly benefits from the same phishing-resistant trust model.
Do passkeys work with native mobile and desktop apps?
They do, and the mechanism is more involved than browser-based passkeys. Websites use the WebAuthn browser API directly; native apps use platform-specific credential APIs that sit beneath the browser layer.
- iOS and macOS: the Authentication Services framework and iCloud Keychain handle passkey creation, storage, and sync. Apple's passkey documentation confirms that iCloud Keychain can sync passkeys across all Apple devices signed into the same Apple ID, giving you access on iPhone, iPad, and Mac without re-registering.
- Android: the Credential Manager API (introduced in Android 9, broadly adopted from Android 14) connects apps to Google Password Manager or any compatible third-party credential provider. Passkeys sync across Android devices via the Google account.
- Windows: Windows Hello provides the on-device biometric or PIN verification, and Microsoft accounts can sync passkeys across Windows devices. Browsers on Windows (Chrome, Edge, Firefox) also support WebAuthn for web-based passkey flows.
For a native app to use a passkey tied to a specific domain, the app binary must be cryptographically associated with that domain. On Android this is done via Digital Asset Links; on iOS via Associated Domains entitlements. Without this binding, the operating system blocks the app from accessing the passkey credential for that site. This is a security control, not a quirk.
Pro Tip: To check whether an app supports passkeys, look in its security or account settings for a "Passkeys", "Sign-in methods", or "Passwordless sign-in" option. If the login screen shows a "Sign in with passkey" prompt, the app is already enrolled.
What devices and operating systems support passkeys?
Before setting up passkeys, confirm your devices meet the minimum requirements. The checklist below covers the most common UK user configurations.
Mobile
- iOS 16 or later (iPhone 8 and above have the Secure Enclave required for private key storage)
- Android 9 or later for basic support; Android 14 or later for the full Credential Manager API
Desktop and laptop
- Windows 10 version 1903 or later with a TPM 2.0 chip and Windows Hello configured
- macOS Ventura (13) or later with Touch ID or a paired iPhone for biometric confirmation
- ChromeOS 108 or later
Browsers
- Chrome 108+, Safari 16+, Edge 108+, Firefox 122+ all support WebAuthn for web-based passkey flows
Legacy devices: if your device predates these baselines, passkeys simply will not be available. The practical fallback is to keep a strong password managed through a credential manager and enable a second factor. Upgrading the device is the only route to full passkey support; there is no software workaround for missing hardware security chips.
Which apps and services already support passkeys?
Adoption has accelerated considerably. The categories most relevant to UK users that already support passkeys include:
- Platform accounts: Google, Apple ID, and Microsoft accounts all support passkeys, which means the apps tied to those ecosystems (Gmail, Outlook, iCloud) benefit immediately.
- Password managers: Bitwarden supports passkey storage and sync across devices, letting you use passkeys on services even when switching between platforms. Bitwarden's open-source model makes it a credible choice for security-conscious users.
- Hardware security keys: Yubico's YubiKey range (YubiKey 5 series and later) supports FIDO2 and can act as a device-bound passkey or a recovery credential for high-security accounts. Unlike synced passkeys, a YubiKey's private key cannot be extracted or copied.
- Consumer services: a growing number of retail, social, and productivity platforms support passkeys. The directory at Passkeys maintains an up-to-date list of supporting services.
Many critical accounts now support passkeys, but a significant portion of services still rely on passwords. The practical advice: convert your highest-risk accounts (email, banking, primary platform accounts) first, and treat passkeys as the default for any new account registration where the option exists.
How to set up and use passkeys on iPhone, Android, Windows, and password managers
The general flow is the same across platforms: sign in to the service, navigate to security settings, and register a passkey. The platform handles the cryptographic side automatically.
iPhone and iCloud Keychain
- Open the app or website and sign in with your existing credentials.
- Go to Account settings → Security → Passkeys (exact wording varies by service).
- Tap Add a passkey or Create a passkey.
- Authenticate with Face ID or Touch ID when prompted.
- iCloud Keychain saves the passkey and syncs it to your other Apple devices automatically.
Android and Google Password Manager
- Sign in to the app or website.
- Navigate to Security settings and select Create a passkey.
- Confirm with your fingerprint, face scan, or device PIN.
- Google Password Manager stores the passkey and makes it available across your Android devices and Chrome on other platforms.
Windows Hello
- Open the service in Edge or Chrome on Windows.
- In account security settings, choose Add a passkey.
- Windows will prompt for Windows Hello verification (fingerprint, face, or PIN).
- The passkey is stored locally and, where Microsoft account sync is enabled, available across your Windows devices.
Third-party password managers (Bitwarden)
Bitwarden supports passkey storage as part of its credential vault. After creating a passkey on a supported service, Bitwarden can store and autofill it across devices, which is particularly useful if you move between iOS, Android, and Windows regularly. Understanding how credential managers store passkeys and passwords securely helps clarify why vault encryption matters for this use case.
Recovery checklist before removing your password fallback:
- Register the passkey on at least two devices.
- Enable cloud sync (iCloud Keychain, Google Password Manager, or Bitwarden).
- Register a hardware security key (such as a YubiKey) as a backup credential where the service allows it.
- Confirm the service has an account recovery process you can access without the passkey.
Pro Tip: Register a secondary device or a hardware key before disabling your password. If your primary device is lost or reset before you have a backup, account recovery becomes significantly harder.
Passkeys versus password managers and hardware security keys
Each approach solves a different part of the authentication problem. The right choice depends on the account's risk level and your device setup.
| Dimension | Passkeys (synced) | Hardware security key (e.g. YubiKey) | Password manager only |
|---|---|---|---|
| Compatibility | iOS 16+, Android 9+, Windows 10+, modern browsers | FIDO2-supporting services; USB-A/C or NFC required | Works with any service that accepts passwords |
| Storage and sync | Synced via platform keychain (iCloud, Google, Microsoft) or a FIDO2-capable vault like Bitwarden | Device-bound; private key cannot be extracted or synced | Encrypted vault synced across devices |
| Recovery and lockout risk | Moderate: losing all synced devices without a backup is a lockout risk | Low for the key itself; losing the physical key requires a backup key or recovery code | Low: vault recovery via master password or emergency kit |
| Phishing resistance | High: private key is cryptographically bound to the legitimate domain | Very high: key is offline and non-syncable | None: passwords can be phished |
| Convenience | High: biometric prompt, no typing | Moderate: requires physical key present | High for saved passwords; lower for new or unsaved sites |
When to choose each option:
- Use synced passkeys as the default for everyday accounts where convenience matters and cloud sync is acceptable.
- Use a hardware security key (YubiKey FIDO2) for accounts where absolute assurance is needed: administrator accounts, financial services, or any account where a breach would be catastrophic. The FIDO Alliance confirms that hardware keys remain offline and non-syncable, which removes the cloud-sync attack surface entirely.
- Keep a password manager for services that do not yet support passkeys. Password reuse across services remains one of the most common causes of account compromise, so a well-managed vault is still essential during the transition period.
What are the risks and limitations of passkeys?
Passkeys are more secure than passwords, but they introduce new failure modes that are worth understanding before you commit.
Lockout risk is the most serious. Synced passkeys improve cross-device convenience but create recovery considerations if all synced devices are lost simultaneously. If your iPhone is stolen, your iPad is broken, and your Mac is wiped before you set up a backup, iCloud Keychain recovery depends on your Apple ID credentials and account recovery contacts being correctly configured. The same logic applies to Google and Microsoft ecosystems.
Ecosystem limits are a practical constraint. Not every service supports WebAuthn/FIDO2 yet, and some older enterprise systems have no passkey path at all. A hybrid model, passkeys where supported and strong passwords with a manager elsewhere, is the realistic approach for most UK users and organisations right now.
Cross-platform caveats: a passkey created on iOS is stored in iCloud Keychain by default. Using it on an Android device requires either a cross-device authentication flow (scanning a QR code with your iPhone) or storing the passkey in a cross-platform manager like Bitwarden. This friction is real and worth planning for if you regularly switch between ecosystems.
Warning: never rely on a single-device copy of a passkey for a critical account. If that device is lost, reset, or damaged before you register a backup, recovery depends entirely on the service's account recovery process, which varies widely.
For practical guidance on protecting your accounts from related threats, the Pocketapp article on protecting yourself from fake mobile apps covers the social-engineering risks that passkeys alone cannot address.
Developer checklist for adding passkey support to an app
Product owners: the list below is designed to hand directly to your engineering team. It covers the technical requirements, association mechanisms, recovery flows, and UX considerations for a correct passkey implementation.
Technical implementation
- Implement WebAuthn registration (
navigator.credentials.create) and authentication (navigator.credentials.get) flows on the server side, following the FIDO2 and WebAuthn specifications. - On iOS, integrate the Authentication Services framework (
ASAuthorizationController); on Android, use the Credential Manager API. - Store only the public key and credential metadata on your server. Never store the private key or a hash of it.
- Validate the signed challenge server-side on every authentication attempt; reject any response that does not match the stored public key.
App-to-domain association
- Android: publish a
/.well-known/assetlinks.jsonfile on your domain and declare the Digital Asset Links relationship in your app manifest. - iOS: add the Associated Domains entitlement (
webcredentials:yourdomain.com) to your app and host anapple-app-site-associationfile at/.well-known/. - Without these bindings, the OS will block the app from accessing passkey credentials for your domain.
Recovery and account management
- Implement a server-side credential registry so users can view, name, and remove registered passkeys from their account settings.
- Allow registration of multiple passkeys (different devices, a hardware key) before removing the password fallback.
- Provide a clear account recovery path: email verification, backup codes, or support-assisted recovery for users who lose all registered credentials.
- Follow the FIDO Alliance's guidance on recovery workflows to avoid locking legitimate users out during rollout.
Security at the app layer
- Review your secure mobile app launch checklist before going live with passkey flows.
- Plan for a hybrid model during transition: keep password fallback for users on unsupported devices, and track which user segments can migrate to passkeys first.
Pro Tip: Label your passkey button "Sign in with passkey" or "Use passkey" rather than generic terms like "Passwordless". Users recognise the word "passkey" from platform prompts, so matching that language reduces confusion and support tickets.
Why we favour passkeys for new app projects
Passkeys are not simply a better password. They change the trust model at a structural level: the secret never leaves the device, which means a server breach cannot expose user credentials. For apps handling sensitive data, that distinction matters enormously in practice.
At Pocketapp, we recommend passkeys as the default authentication approach for new greenfield apps, particularly those handling personal health data, financial information, or SSO integrations where a single compromised credential could cascade across multiple services. The biometric authentication integration work we do for clients already positions us well to implement the platform APIs and UX flows that passkeys require.
The honest caveat: passkeys are not a complete solution on their own. Recovery planning, hybrid fallback for unsupported devices, and clear in-app UX are all part of a responsible implementation. Product owners who treat passkeys as a drop-in password replacement without addressing these considerations will create support problems. The right time to plan recovery flows and association mechanisms is during discovery, not after launch.
Pocketapp's passkey implementation services
Getting passkeys right in a native app requires more than following the WebAuthn spec. It means correct platform API integration on both iOS and Android, server-side credential management, app-to-domain association, and a recovery flow that does not strand legitimate users.
Pocketapp's mobile app development service covers the full implementation path: discovery to map your current authentication architecture, secure backend development with WebAuthn endpoints, platform integration for iOS Authentication Services and Android Credential Manager, and cross-platform consistency so your passkey flows behave correctly on both ecosystems. We also build the recovery workflows and credential management screens that users need to stay in control of their accounts. If you are planning a new app or adding passkey support to an existing one, get in touch to discuss your requirements during a discovery call.
Sources
- Google — Passkeys (developer documentation)
- Apple — Passkeys (developer documentation)
- NCSC — Passkeys guidance
- Proton — Passkey vs password
- FIDO Alliance — specifications
- Google — Passkeys developer guides
FAQ
Do passkeys work with apps, not just websites?
Yes. Native apps on iOS, Android, and Windows use platform credential APIs (Authentication Services, Credential Manager, Windows Hello) to create and authenticate with passkeys, exactly as websites use the WebAuthn browser API.
Which passkey manager is best for UK users?
For most users, the built-in platform option (iCloud Keychain on Apple, Google Password Manager on Android) is the simplest starting point. Bitwarden is the strongest cross-platform choice if you move between iOS, Android, and Windows, as it syncs passkeys across all three. For high-security accounts, a YubiKey FIDO2 hardware key provides device-bound isolation that no cloud-synced option can match.
How do I set up a passkey in an app?
Sign in to the app with your existing credentials, navigate to security or account settings, and select "Add a passkey" or "Create a passkey". Your device will prompt for biometric or PIN confirmation, then store the passkey automatically via your platform credential manager.
Which apps and services support passkeys?
Google, Apple ID, Microsoft accounts, and a growing number of retail and productivity services support passkeys. The passkeys.io directory maintains a current list. Convert your highest-risk accounts (email, banking, primary platform accounts) first.
What happens if I lose my device and have no backup passkey?
You will need to use the service's account recovery process, which typically involves email verification or backup codes. This is why registering a second device or a hardware security key before removing your password fallback is strongly recommended.