Passkeys without Biometrics? Does this work?

Can Passkeys Work Without Biometrics?#

Yes, passkeys can work without biometrics by using local authenticators like PINs, patterns, or device passwords. These methods provide secure authentication when biometric options like fingerprint or facial recognition are unavailable. Passkeys rely on the device's local authenticator, which is set up by the user and not controlled by the relying party.

---

How Passkeys Work Without Biometrics#

Passkeys are built on WebAuthn, a standard for passwordless authentication. Typically, passkeys use a local authenticator for user verification. When biometrics like fingerprint or facial recognition are unavailable, the local authenticator provides an alternative method of authentication.

What Is a Local Authenticator?#

A local authenticator is a mechanism on your device that verifies your identity. Examples include (all non-biometric):

• PIN codes - A numeric code you enter to unlock your device.
• Patterns - A swipe pattern drawn on a touchscreen.
• Device passwords - Alphanumeric passwords used for device access.
• Screen locks - Any other mechanism that restricts device access.

How Does It Work with Passkeys?#

1. User Setup: The user configures their local authenticator on their device.
2. Passkey Creation: The device generates a cryptographic key pair during account setup.
   • The private key is securely stored on the device.
   • The public key is shared with the service (relying party).
3. Authentication: When the user attempts to log in:
   • The relying party sends a challenge to the device.
   • The device uses the private key to sign the challenge.
   • The local authenticator (e.g., PIN, pattern) verifies the user's identity before signing.

Advantages of Using Passkeys Without Biometrics#

• Accessibility: Allows users without biometric-capable devices to use passkeys.
• Security: Local authenticators are tied to the device and can't be intercepted remotely.
• User Control: Users can choose the method they are most comfortable with, enhancing adoption rates.

Can Developers Influence Local Authenticators?#

No, developers and relying parties cannot directly control the type of local authenticator used. This is determined by the user’s device setup. However, developers can design user flows that clearly explain the process and guide users to set up a local authenticator if one isn’t already configured.

Why Is This Important?#

Passkeys without biometrics provide inclusivity and flexibility. Not all users have access to the latest biometric technology, but they can still benefit from the security and convenience of passwordless authentication through alternatives like PINs and patterns.

---

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →