What a passkey is, and what it does not prove

Published October 28, 2026. Applies to the demo's sign-in as built today.

The demo uses passkeys instead of passwords. A passkey proves that the person signing in holds a key that was registered here. It does not prove who that person is, where they live or whether they may vote anywhere.

What a passkey is

The FIDO Alliance, the industry body behind the standard, describes passkeys as "a password replacement technology" and as "FIDO cryptographic credentials that are tied to a user's account on a website or application" [1]. When you create an account on the demo, your device makes a pair of keys. The private key stays with you, in your device or your password manager. The demo stores only the public key, which can check a signature but cannot make one.

To sign in, the demo sends a one time challenge, your device signs it after you unlock it, and the demo checks the signature. Nothing secret crosses the network, so there is no password for anyone to steal from the demo's database.

Your fingerprint or face stays on your device

If you unlock the passkey with a fingerprint or your face, that check happens on your device. The FIDO Alliance states that "biometric information and processing continues to stay on the device and is never sent to any remote server" [1]. The demo never receives a fingerprint, a face image or a device PIN, and it has no way to ask for one.

Why it resists phishing

A passkey is bound to the site that created it. The demo's passkeys are bound to demo.myvoteforward.com, so a look-alike site cannot use them, and they do not carry over to myvoteforward.org or any other address. NIST's digital identity guideline recognizes this kind of binding, "verifier name binding," as one of two methods of phishing resistance [2].

Syncing, and losing a device

Many passkeys sync between your own devices through your password manager [1]. NIST notes that because a syncable key can be exported, it is not accepted at its highest assurance level [2]. That is fine for a demonstration, and it is one reason a real election system would need its own reviewed design.

The demo collects no email, so it cannot send you a reset link. When you create an account you get ten single use recovery codes. Keep them somewhere safe. If you lose every passkey and every code, the account cannot be recovered, and you can start again as a guest.

What a passkey does not prove

It does not prove your legal name. The demo never asks for it.
It does not prove where you live. The scenario you pick is context you choose, not verified residence.
It does not prove you are registered or eligible to vote. Only your election authority decides that.
It does not make your saved answers anonymous. They are private account data, protected and deletable, as the privacy page explains.

You can add a second passkey, see where you are signed in and sign out other sessions on the security page.

Sources

FIDO Alliance, "Passkeys," fidoalliance.org/passkeys, accessed October 28, 2026.
National Institute of Standards and Technology, Special Publication 800-63B, Authentication and Authenticator Management (revision 4), pages.nist.gov/800-63-4/sp800-63b.html, accessed October 28, 2026.