Do passkeys work offline?

A passkey is a FIDO credential: a key pair that replaces a password. The FIDO Alliance describes passkeys as cryptographic key pairs used from end-user devices such as computers, phones and security keys. They can be synced across a person’s devices or bound to one device, which FIDO calls synced passkeys and device-bound passkeys. Apple notes that servers keep only the public keys, and that a passkey is linked to the app or website it was created for, so it cannot be used on a fraudulent site.

The relying party never receives the private key. What it gets at each sign-in is a signature.

Android’s Credential Manager documentation sets out the sequence plainly:

1. The app asks its server for sign-in options, and the server sends a challenge and stores it for later verification.
2. The person consents with their device’s screen lock, such as a fingerprint, face or PIN.
3. The credential provider uses the stored private key to sign the challenge.
4. The app sends the signed assertion to the server, which checks that the challenge matches the one it stored and that the signature verifies with the public key.
5. If both checks pass, the person is signed in.

The WebAuthn standard explains why the challenge has to come from the relying party. Web Authentication depends on randomised challenges to avoid replay attacks, so challenges must be randomly generated by the relying party in an environment it trusts, such as on the server side, and the value returned must match what was generated. A challenge the device made up for itself would prove nothing to anyone else.

Several steps do happen on the device with no connection:

• User verification. FIDO says the person approves sign-in with the same biometric, PIN or device password they use to get into the device, and that biometric processing stays on the device.
• Signing. The authenticator computes the signature locally.

The parts that need a connection are the ones at either end. The challenge comes from the relying party, and the relying party verifies the result. If the app or browser cannot reach the relying party’s server, sign-in cannot finish, however healthy the passkey is.

A device-bound passkey on a hardware security key has the same limit: the key can sign anywhere, but only the relying party can issue the challenge and accept the answer.

Synced passkeys add a second dependency. Apple says passkeys are synced with iCloud Keychain so they are available across a person’s Apple devices. A passkey created on one device reaches another through that sync service, so a brand new device needs a connection before the passkey appears on it.

WebAuthn lists hybrid as an authenticator transport and defines it as contacting the authenticator through a combination of data transport and proximity mechanisms, for example signing in on a desktop computer with a smartphone. This is the flow where a laptop shows a QR code and a phone completes the sign-in.

The FIDO Client to Authenticator Protocol (CTAP) 2.2 specifies how. The hybrid transport involves both network communication through a tunnel service, a high-availability network service whose domain name the authenticators know, and Bluetooth Low Energy transmissions to show proximity. Bluetooth shows the phone is physically near the computer, while the tunnel service relays the messages between them. So hybrid sign-in is not a way to use a passkey with no network.

The signature check at the centre of a passkey is ordinary public key cryptography, and nothing in the mathematics needs the internet. What ties sign-in to a network is that the verifier is the relying party’s server. That suggests three practical choices for apps used in places without connectivity:

• Sign in while connected, then keep a local session for a period you decide, accepting that a revoked account will not be noticed until the device reconnects.
• Bind a separate device key to the account while online, using account binding, and use that key for checks between devices that cannot reach the server.
• Keep authentication and authorisation separate, so a device that has proved who someone is still applies its own rules about what they may do offline.

Passkeys answer phishing and password reuse for online sign-in. The standards describe signing in to a relying party, not two devices authenticating each other when neither can reach one, and that job needs a different tool.