The UX Challenge of Passkeys
The cryptography of passkeys is elegant. The user experience is still a work in progress. Most users have used passwords for their entire digital lives — the mental model of "type a secret to prove you're you" is deeply ingrained. Introducing passkeys means not just changing a technical mechanism but reshaping a user expectation that has 30 years of precedent.
Onboarding: Upgrade, Don't Replace
The highest-converting passkey onboarding pattern is the post-login upgrade prompt: after a user successfully signs in with their password, show a one-time prompt — "Sign in faster next time. Create a passkey?" This meets users where they are, requires no explanation of what a passkey is to access the app, and frames passkeys as an upgrade rather than a requirement. Conversion rates for this pattern are substantially higher than forcing passkey creation during account registration.
Naming: Call It What the Platform Calls It
Different platforms have different names for the same underlying technology: Face ID, Touch ID, Windows Hello, passkey. The most effective UX uses the platform's own vocabulary. On iOS, say "Face ID." On Android, say "fingerprint" or "face unlock." Use "passkey" as the canonical term in settings and documentation, but match the platform's language in the moment of authentication. Users trust names they recognize from their OS.
The Fallback Problem
You must always have a fallback. Passkeys fail when: the device is lost, the user switches devices and hasn't synced, biometrics are unavailable (wet hands, injury), or the user simply doesn't have a passkey set up yet. The fallback can be an email magic link, a TOTP code, or — for legacy users — a password. The key is making the fallback accessible without making it the default path that undermines passkey adoption.
Cross-Device Login
One of the trickier UX moments is cross-device login — when a user wants to sign into a laptop using the passkey stored on their phone. WebAuthn supports this via a QR code flow: the laptop shows a QR code, the user scans it with their phone, approves with biometrics, and the laptop session is authenticated. This flow requires careful UX framing — most users don't expect to need their phone to sign into a laptop — but it's a one-time experience that becomes intuitive quickly.