Security

What Is a Passkey? Passwordless Login Explained

A passkey is a passwordless login credential — a cryptographic key pair stored on your device and unlocked with your fingerprint, face or device PIN — that can't be phished the way a password can.

Key takeaways

Passkeys replace passwords with a public/private key pair; the private half never leaves your device.
You approve sign-in with biometrics or your device PIN.
They're tied to the real website, so a look-alike phishing site can't trick you into using them.
A passkey protects access to an account — it's separate from the keys that control your coins.

How a passkey works

When you register a passkey, your device creates a key pair. The public key goes to the service; the private key stays on your device (or in your synced device keychain), protected by biometrics or a PIN. To sign in, the service sends a challenge, your device signs it after you unlock with a fingerprint, face or PIN, and the service verifies it with the public key.

Because there's no password to type or steal, there's nothing for a phishing site to capture. The passkey is also bound to the genuine site's domain, so a look-alike domain simply doesn't get a valid response.

Passkeys vs passwords

Passwords can be reused, guessed, leaked in a breach, or typed into a fake site. Passkeys are unique per site, never transmitted, and require your device plus your biometric or PIN. They remove the most common account-takeover routes.

What a passkey does and doesn't protect

A passkey secures login to an account or app. It's separate from the private keys that control coins on the blockchain. In a non-custodial wallet, protecting the login helps keep other people out of the app on your device, while the wallet's own recovery information still has to be backed up and kept private.

Tips

Register passkeys on devices you control and keep the device locked
Keep a recovery path for your account in case you lose the device
Combine with a PIN or confirmation step for sending, so unlocking the app isn't enough to spend

Example

You open your wallet and instead of typing a password you're prompted for your fingerprint. Your phone signs the wallet's challenge with the passkey. A fake wallet site can't ask for that signature because it isn't the real domain.

Put it into practice

Sign in with a passkey

Scrypt Wallet supports passkey login and PIN-protected send confirmation, so unlocking the app isn't enough to move funds. Set it up when you create your free account.

Create a free wallet Get Scrypt for Android

Frequently asked questions

Are passkeys safer than passwords?

Generally yes: they can't be reused, guessed or phished the way passwords can, because the private key never leaves your device and is bound to the real site.

What if I lose my phone?

Passkeys can be synced through your device's secure keychain or re-registered from another device. Make sure you know your account's recovery options first.

Does Scrypt Wallet support passkeys?

Yes — Scrypt Wallet offers passkey login along with PIN-protected send confirmation.

Related terms

Written by the Scrypt Wallet team · Updated 2026-09-29. General education, not financial, tax or legal advice.