---
url: 'https://www.corbado.com/faq/user-data-processed-during-passkey-authentication'
title: 'What user data is processed during passkey authentication?'
description: 'Explore the types of user data processed in passkey authentication and how they are handled to ensure privacy and security.'
lang: 'en'
keywords: 'passkey user data, data processed passkey, user data in passkeys'
---

# What user data is processed during passkey authentication?

## What Types of User Data Are Processed During Passkey Authentication?

Passkey authentication is designed to minimize the use of sensitive user data, ensuring
privacy and security. Understanding what data is processed during
[passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) and login helps organizations
comply with privacy regulations while maintaining
[user trust](https://www.corbado.com/faq/fallback-management-user-trust-passkey-retention).

### Data Processed During Passkey Creation

1. **Email Address (Optional):**
    - Used temporarily to identify the user during account linking.
    - Not stored permanently in privacy-conscious implementations.

2. **Public Key:**
    - Generated on the user’s device and sent to the server for storage.
    - This key is not sensitive as it cannot be used to reconstruct private information.

3. **Device Information:** Metadata such as device type or operating system may be
   processed to ensure compatibility and enhance security.

### Data Processed During Passkey Login

1. **Credential Identifier:** A unique identifier associated with the user’s passkey, used
   to retrieve the correct public key for verification.

2. **Challenge Response:**
    - A cryptographic signature generated by the user’s device to prove possession of the
      private key.
    - This ensures authentication without exposing sensitive data.

3. **Optional PII (For Account Recovery):** Some implementations may process temporary PII
   like email to identify user accounts, especially during recovery scenarios.

### Privacy and Security Measures

- **No Permanent PII Storage:** Passkey systems can operate without storing sensitive data
  permanently.
- **Encryption:** All data transmitted during authentication is encrypted to prevent
  interception.
- **Data Minimization:** Only the minimum required data is processed, adhering to
  privacy-by-design principles.

### Summary of Data Handling in Passkeys

Passkey systems prioritize privacy by minimizing the data processed during authentication.
Key information like public keys and challenge responses are secure by design, while
temporary PII use is strictly controlled. This approach ensures both compliance with
privacy regulations and enhanced security for users.

## Read the full article