When Are Passkeys Stored?

When Are Passkeys Stored?#

Passkeys are stored on the user’s device after being created during the WebAuthn register process. The cryptographic keys are securely stored within hardware-backed storage like the Trusted Platform Module (TPM) on desktops or the Secure Enclave on iOS devices.

Passkeys are stored on the user’s device after creation.
The private keys are securely stored in hardware-backed storage such as TPM or Secure Enclave.
Only public keys are shared with the WebAuthn server, ensuring the security of the private key.

How Passkeys Are Stored#

When a passkey is generated, it consists of a public key and a private key. The private key is securely stored on the user's device, often in hardware-backed storage:

Trusted Platform Module (TPM): On Windows and Linux devices, passkeys are stored within the TPM, which is a dedicated microcontroller designed to secure hardware through integrated cryptographic keys.
Secure Enclave: For Apple devices, the Secure Enclave is a coprocessor that provides all cryptographic operations for Data Protection key management and ensures that passkeys remain protected even if the main operating system is compromised.

When Passkeys Are Stored#

Passkeys are stored immediately after they are created during the registration process. This usually happens the first time a user signs up for a service using passkeys. Here's a step-by-step process:

User Registration: During user registration, the passkey is created and stored on the device.
'WebAuthn Server Interaction: Only the public key is sent to the WebAuthn server, ensuring that the private key never leaves the user’s device.
Subsequent Logins: During subsequent logins, the stored private key is used to sign a challenge sent by the server, proving the user’s identity without ever exposing the private key.

Security Implications#

The storage method of passkeys is designed to prevent unauthorized access and ensure that even if a device is compromised, the passkey remains protected:

Local Storage: Since passkeys are stored locally, they are less vulnerable to mass data breaches that affect server-side databases.
Biometric Protection: On many devices, access to the private key is further protected by biometric authentication, such as fingerprint scanning or facial recognition.

About Corbado

Corbado is the Passkey Intelligence Platform for large-scale CIAM teams running consumer authentication. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →