Passkeys Are Not 100% Safe: New Attacks Explained

byMr.Tarsem Singh • • 2 min read
0
Passkeys Are Not 100% Safe: New Attacks Explained
Passkeys Are Not 100% Safe: New Attacks Explained

Passkeys were created to take the place of passwords because they can't be tricked. For regular logins this idea still works.. From 2025 and moving into 2026 experts in security have discovered that passkeys can still be attacked. The problems are not in the math that keeps passkeys safe. The issues come from how operating systems, browsers and password tools handle and keep passkeys. Also attackers can make users go back, to safe ways to log in. Here is what has really been discovered why it is important and what it means for how you should use passkeys.

What Passkeys Actually Protect Against

A passkey is a pair of keys. The private key stays on your device or in your password manager. The public key is stored on the website’s server. When you log in the website sends a challenge. Your device signs that challenge using the key. The website then checks the signature against the key it already has. Nothing sensitive ever moves over the network.. The signature is tied to the exact domain of the website asking for it.

This setup stops the common way hackers take over accounts: classic phishing. That’s when a fake login page tricks you into typing your password and a one-time code into a site that looks real.. A passkey signature can only be made for the real domain. A fake site can’t trick you into giving it a signature. That’s why passkeys are called phishing-not phishing-proof. The difference matters. "Resistant" means the system can still be beaten by attacks that don’t break the cryptography directly—like ones that target your device your email or your trust, in a message. So while passkeys stop the common threat they don’t rule out every possible attack.

The New Attacks Researchers Have Found

  • The Pass-the-Passkey Windows Flaw

A passkey is a pair of keys that help keep you online. The passkeys private key is stored on your device or, in your password manager. The passkeys public key is stored on the websites server. When you want to log in to a website the website will send a challenge to your device. Your device will then use the passkeys key to sign the challenge and the website will check the signature against the passkeys public key that the website already holds. I find this way of logging in simple and reassuring.  This way nothing secret is sent over the internet. The signature is only good for the exact website that asked for it.

This system is really good at stopping the common type of account takeover which is called phishing. Phishing is when a bad guy makes a login page that looks like a real one and tries to trick you into typing in your password and a special code. But with a passkey the signature is tied to the website so a fake site cannot get a valid signature from you. That is why passkeys are said to be resistant to phishing. They are not proof, against phishing because there might be other ways for bad guys to get around the security measures rather than breaking the security directly.

  • Malware That Skips the Browser Entirely

Grafnetters research and some other researchers found out that bad software that is already running on a Windows computer can sometimes use a Windows Hello for Business key without asking the user to unlock it again. This is a big deal.

Some other ways that hackers can get in include asking the user to log in over again until they just give up and say yes and something called a "passkey detour" where a hacker redirects a real login request to their own fake session instead of the real one.

It is very important to understand how these attacks work. Every single one of them needs software to be running on the users device already. Windows Hello for Business keys are not like passwords or SMS codes that can be stolen from away. None of these attacks can just make a Windows Hello for Business key from scratch they need to be, inside the users computer.

  • Google Password Manager and Synced Passkey Recovery

Researchers at Palo Alto Networks Unit 42 found a way to attack Googles synced passkey implementation in Chrome. They figured out how to get the keys that are behind a persons synced passkeys. The thing about synced passkeys is that they are easy to use because they go from one device to another through your password manager or cloud account.. The problem is that the same thing that makes them easy to use also makes them a target, for bad people. If someone bad gets into the account or device where the synced keys are stored then the passkeys that are stored there can be seen by that person too. Palo Alto Networks Unit 42 showed that synced passkeys are not as safe as we thought. Synced passkeys are still a risk because they can be accessed if the account or device that stores them is compromised.

  • FIDO Authentication Downgrade Attacks

Proofpoint researchers documented a different approach: instead of attacking the passkey itself, a phishing kit can detect that a target has a passkey enrolled and quietly steer the login flow toward a weaker fallback method, such as an SMS code or a password, which the attacker's proxy can then intercept. Proofpoint said it had not yet observed this specific downgrade technique being used in real attacks at the time of its report, but the technique is proven to work, and downgrade attacks are already a known category researchers expect attackers to lean on more.

Adversary-in-the-Middle Attacks Against MFA

Fallbacks

This is the important attack for ordinary users to understand because it does not require any software bug at all. If your account still allows a password and code fallback alongside your passkey an attacker does not need to break the passkey. They just need to trick you into using the fallback.

The attacker will use something called Adversary-in-the-middle phishing kits. These kits sit a login page between you and the real site. They capture whatever you type, including one-time codes. Then they hand the resulting session cookie to the attacker.

You can even rent these phishing kits. They are cheap and easy to get. Microsoft has reported that one phishing platform was responsible, for most of the phishing traffic it blocked through mid-2025. The passkey itself was never touched. The accounts weakest login option, the password and code fallback was the problem.

Why These Attacks Don't Break the Core Cryptography

None of the research mentioned above explains the mathematics that underlie FIDO2 or WebAuthn the open‑standard technologies that passkeys rely on. Every attack discovered up to fits into one of three types: first a device or account is already taken over by malware; second, a detail of the implementation—such as logging or key storage—reveals something that should stay hidden; third a service still permits a weaker fallback method and attackers target that instead of the passkey. This difference is important. It does not mean that passkeys are useless. It simply shows that a passkey is only as secure, as the operating system, the browser and the account settings that surround it.

What Microsoft and Google Are Doing About It

Microsoft has patched the Windows Event Logging Service issue tied to CVE-2026-34348 and applied server-side mitigations on the Entra ID side for the related relay problem. According to independent testing referenced in coverage of the research, Microsoft's July 2026 Windows updates made the specific replay technique unusable. Microsoft has also been pushing organizations further toward passkeys generally, with plans to make passkeys the default sign-in method in Entra ID starting September 1, 2026, and to retire its own SMS and voice authentication options by February 1, 2027.

Google has not published a detailed public response specific to the Unit 42 findings on Chrome's synced passkey storage as of this writing, so anyone concerned about that specific issue should check Google's official security blog or Chrome release notes for the latest guidance rather than relying on secondhand summaries.

How to Protect Yourself

None of this research is a reason to abandon passkeys. It is a reason to set them up carefully.

  • Keep your operating system and browser updated. The Windows fixes for the Pass-the-Passkey research only help if the patches are installed.
  • Use endpoint protection and be cautious about what you install. Every device-side attack in this research assumes malware is already running. Reducing the odds of an infection in the first place removes the precondition these attacks depend on.
  • Turn off weaker fallback methods where you can. If a service lets you remove SMS or password fallback once a passkey is set up, do it. A passkey with a phishable fallback next to it is only as strong as that fallback.
  • Understand the trade-off between synced and device-bound passkeys. Synced passkeys are easier to use across devices but depend on the security of your password manager or cloud account. Device-bound passkeys, usually stored on a physical security key, cannot be exported or synced at all, which is why many organizations reserve them for high-privilege accounts.
  • Watch for repeated or unexpected login prompts. A passkey approval request you did not initiate is a signal to investigate, not to tap through.

Passkeys vs Passwords and SMS Codes: What Actually Changed

It helps to see the attack surface side by side, since "not 100% safe" means something different for each method.

Passwords: Can be phished directly. Can be reused across sites, so one breach exposes many accounts. Can be guessed or cracked if weak. No cryptographic binding to the site you think you are logging into.

SMS one-time codes: Can be phished through AiTM proxies exactly like passwords. Can also be intercepted through SIM-swap attacks, where an attacker convinces a mobile carrier to move your number to a new SIM. The code itself has no idea which website it is being entered on.

Authenticator app codes (TOTP): Harder to intercept than SMS but still phishable through the same AiTM technique, since the six-digit code is just another value a fake login page can capture and relay to the real site in real time.

Passkeys: Cannot be phished directly, because the cryptographic signature is bound to the real site's domain. The attacks described in this article target the device, the implementation, or a fallback method sitting next to the passkey, not the passkey's core authentication step itself.

That comparison is the actual reason security teams still recommend passkeys over every alternative, even after this year's research. The new attacks raise the bar for what "secure" needs to include, they do not lower passkeys back down to the level of a password.

Frequently Asked Questions

Can someone steal my passkey by hacking the website I log into? 

Not in the way they could steal a password. A website only ever stores your public key, which is useless to an attacker without the matching private key on your device. A server breach exposing public keys does not let anyone log in as you.

Do I need to stop using synced passkeys because of the Google Password Manager research? 

Not necessarily. The demonstrated attack required a level of device access that most casual attackers do not have. If you are managing a high-value account, such as a primary email or a financial account, consider a hardware security key for that specific account instead of relying only on synced passkeys.

Is a hardware security key completely safe from these attacks? 

Hardware-bound passkeys are not vulnerable to the synced-key extraction issue, since there is no private key to sync or export in the first place. They are still only as safe as the device you plug them into, and physical loss or theft of the key itself remains a separate risk to plan for.

Should I turn off passkeys until these issues are fully resolved? 

No security team or researcher covered in this article has recommended that. The consistent advice is to keep passkeys enabled, keep devices updated, and reduce reliance on weaker fallback methods, not to go back to passwords.

Should You Still Use Passkeys?

Yes. Every attack that we know about needed a device that was already compromised or a problem with the way something was set up that the people who made it are fixing or a weaker option that a passkey- account would not have had to begin with. When you compare passkeys to passwords and SMS codes it is clear that passkeys are a lot better. Passwords and SMS codes are very easy to trick people into giving away. People can buy tools to do this very cheaply. Passkeys make it much harder for people to take over accounts. The best way to think about passkeys in 2026 is to listen to what the security researchers say about them. They say passkeys are an improvement, over passwords but they are not a guarantee that nothing will go wrong. You should think of passkeys as one part of keeping your device and account safe but you should still pay attention to everything else. Passkeys are a thing but they are not the only thing that will keep you safe. You need to use passkeys as one part of a plan to keep your device and account secure.

Disclaimer: Passkey security research is an changing field. The weaknesses mentioned here come from studies and vendor statements that were available when this was written. Patches or fixes might have changed since. For the recent advice look at official sources such, as Microsoft security advisories Google security blog and the FIDO Alliance.


Related Article

Post a Comment

Previous Post Next Post