AuthGuard Request a demo

Phishing-resistant sign-in

A passkey only answers the genuine address.

With FIDO2 / WebAuthn passkeys, people confirm sign-in on their own device with biometrics or a PIN. The browser only uses a passkey at the address where it was created, so a fake page gets nothing it can use. It is the only phishing-resistant method AuthGuard offers.

Talk to us about passkeys See how it works
  • FIDO2 / WebAuthn
  • Local verification required
  • Biometrics stay on the device
  • Security keys with a PIN
Passkey · sign-inillustrative example

Two identical pages, two addresses

  • https://signin.example.comsignedPasskey found. The signature goes to AuthGuard.
  • https://signin-example.com.secure-access.conothingNo passkey for this address. Nothing to steal.
Local verificationfingerprint, face or PIN · stays on the device
  1. Fresh challenge
  2. Address checked
  3. Local verification
  4. Signed in

Watch

Only the genuine address answers.

Narrated in English, with English and Portuguese subtitles. Real product screens; people, organisations and amounts are fictitious.

How it works

One signature per sign-in.

A passkey is a key pair. The private key stays on the person’s device; AuthGuard keeps only the public part.

  1. 01 · Challenge

    The service asks for proof

    Every sign-in attempt gets a fresh challenge, so an old answer is useless for the next one.

  2. 02 · Address

    The browser checks the address

    A passkey is bound to the address where it was created. On a page at any other address, the browser does not even offer it.

  3. 03 · Local verification

    The person unlocks the key

    Fingerprint, face, the device PIN or a security key with a PIN. AuthGuard always requires local verification.

  4. 04 · Session

    AuthGuard verifies and signs in

    The signature is checked against the public key. With single sign-on on, the same sign-in also opens your organisation’s applications.

Illustrative example

A fake email, a perfect copy of the page. Nothing happens.

Ana gets an email asking her to confirm her account on a page that looks exactly like her organisation’s, but sits at a different address. She types her email and reaches for her passkey. The browser offers none, because that is not the passkey’s address.

With a password and a six-digit code, the same page could ask for both and replay them on the spot. With a passkey, the fake page is left with nothing to reuse.

In practice

Built for everyday work.

Authenticators

Use what your team already has

  • The computer’s biometrics or PIN, such as Windows Hello
  • A phone, through the browser’s passkey prompt
  • FIDO2 security keys with a PIN
  • Keys without a PIN are not accepted
Enrolment and recovery

Plan for a lost device

  • The current password authorises the first passkey
  • Later passkeys need a recent strong confirmation
  • We recommend two passkeys per person
  • Recovery codes and an email link to create a replacement passkey
Policy

Require passkeys where it matters

  • The access policy can require a passkey for sensitive applications or for all of them
  • Sensitive applications always ask for a fresh passkey
  • Passkey sessions last up to eight hours
  • People review and remove their own passkeys

Worth knowing

  • A passkey is bound to the address where it was created. If your organisation moves to its own domain, each person creates a passkey at the new address.
  • Support depends on the browser, operating system and authenticator. The product’s tests use Chrome, so test your organisation’s devices during the pilot.
  • Phone approval and six-digit codes remain available, but they are not phishing-resistant.
  • A passkey protects sign-in. To prove what was approved in an operation, use critical-action approval.

In the help centre

Pilot

Start with one application.

Pick one application and a pilot group. We review authenticators, enrolment and recovery with you before rolling out to the whole organisation.

geral@authguard.pt