Passkeys for signing documents, explained

What a passkey is

A passkey is a sign-in and signing credential built on two open standards: the W3C's Web Authentication (WebAuthn), whose Level 3 became a W3C Recommendation on August 25, 2026, and the FIDO Alliance's specifications. The FIDO Alliance describes it as "an authentication credential based on FIDO standards, that can be stored on your phone or computer, or in a hardware security key allowing a user to sign in to apps and websites with the same process that they use to unlock their device (biometrics, PIN, or pattern)."

Under the hood it is a key pair. Apple explains it this way: "One of these keys is public, and is stored on the server. This public key is not a secret. The other key is private, and is what is needed to actually sign in. The server never learns what the private key is." To prove it's you, your device uses the private key to sign a value the website sends, and the website checks the result with the public key.

Three properties make passkeys different from anything you type:

• They belong to one website. WebAuthn says a passkey "can only be used for authentication with the same entity (as identified by RP ID) it was registered with". Your browser won't offer it anywhere else, which is why passkeys resist phishing.
• They unlock with your device's check. A website can require Face ID, Touch ID, Windows Hello or the device PIN each time a passkey is used, so anyone who knows the device PIN can use it too, and Attest requires that check for every signature. The face or fingerprint check happens on your device; does Face ID or my fingerprint get sent when I sign? covers what the website receives instead.
• There is nothing reusable to steal from the website. The website stores only public keys. Google's security team wrote that "Passkeys use public-key cryptography so that data breaches of service providers don't result in a compromise of passkey-protected accounts".

Passkeys that sync, and passkeys that stay on one device

Where the private key lives depends on where you save the passkey. The FIDO Alliance distinguishes passkeys that are "synced between user's devices via a cloud service" from those "that never leave a single device", such as passkeys on a hardware security key.

The large platforms sync passkeys with end-to-end encryption:

• Apple: passkeys "are encrypted and stored in your iCloud Keychain, where they aren't visible to anyone (including Apple)", and they "work on all your devices where you're signed in to the same Apple Account".
• Google: "Passkeys in the Google Password Manager are always end-to-end encrypted", and a backed-up private key is uploaded "only in its encrypted form using an encryption key that is only accessible on the user's own devices."

Syncing lets a new phone pick up your passkeys, and it is why Attest describes a passkey as a key only you control rather than a key tied to one device.

Passkey or password

	Password	Passkey
What the website stores	Your password, or a hash of it	Only a public key, which is not a secret
On a fake website	You can be tricked into typing it	Your browser won't offer it
After a breach at the website	Stolen hashes can be cracked and reused	Stolen public keys can't sign anything
What you remember	The password	No password: you unlock with your face, your finger or the device PIN
Signing a document	A password proves you logged in, not what you approved	The passkey signs a statement naming the exact document

How a passkey signs a document on Attest

On Attest, a passkey isn't just a way to log in: it is the signature.

1. Attest prepares the exact statement you are signing: "I have reviewed and I sign "[title]", the document with SHA-256 fingerprint [hash], with the entries I made on it (SHA-256 fingerprint [hash])", together with the agreement ID, your name and, in place of your email address, a salted commitment to it, the time and a random value. A fingerprint (SHA-256) is a short code calculated from a file's contents: change one character and it changes completely.
2. The statement's SHA-256 becomes the WebAuthn challenge, which your passkey signs together with the website's address and flags recording whether the user was present and verified.
3. Your device asks for Face ID, Touch ID, Windows Hello or the PIN (in Chrome on a computer, a passkey in Google Password Manager can ask for your Google Password Manager PIN), and Attest requires that check.
4. Attest checks the signature against your passkey's public key before recording it.
5. The evidence (the statement, the signature, the passkey's public key and the WebAuthn data) can be re-checked by anyone with any WebAuthn library: that the signed value is the statement's fingerprint, that it was signed on Attest, that the user was present and verified, and that the signature is valid.

Because the statement names the document's fingerprint and everything you entered, the signature fits that document and no other. The drawing or typed name you adopt is how your signature looks on the page; the passkey is what makes it binding. Among the 21 e-signature services we compared in October 2026, Attest and 20 others, no other has each signer sign with their own passkey: Documenso offers passkey re-authentication before signing, on its Enterprise Edition and for signers with a passkey on a Documenso account.

The passkey's second job: unlocking your documents

Attest documents are end-to-end encrypted, so you need a private encryption key to open them. That key is created in your browser and stored on Attest only encrypted, under a key derived from your passkey or from your recovery phrase. The passkey part uses a WebAuthn extension called PRF, which gives Attest's code in your browser a secret only your passkey can produce. WebAuthn's own example: "PRF outputs could be used as symmetric keys to encrypt user data." Attest never sees a private key, a passkey's secret or a recovery phrase.

So, with most passkey providers, the same passkey does two jobs: it unlocks the document in your browser, and it signs it. A passkey whose provider doesn't support PRF still signs, and your recovery phrase or another passkey unlocks your key.

Setting one up

• As a signer: open the link in your invitation and tap Set up with a passkey. With most passkey providers this takes one prompt, and signing is a separate approval. A passkey set up from a signing link can sign agreements but can never be used to sign in.
• As a sender: sign in at attest.datahubz.com, open Security and set up your signing key with a passkey, then save the recovery phrase Attest shows you. It is 32 characters in groups of 4, shown once, and Attest can't recover it.
• On a computer without its own passkey: choose the browser's Use a phone or tablet option and approve on your phone, usually by scanning a QR code.

Attest runs in a browser that supports passkeys, such as Chrome, Safari or Edge, with nothing to install.

A new phone, a lost phone, a second device

• Synced passkeys follow your Apple or Google account to a new device.
• Add a passkey on another device from the Security page, so you have more than one way in. Attest asks you to unlock your key first, with a passkey you already have (on that device or your phone) or your recovery phrase, so signing in with your email alone can't add one, and Attest emails you whenever a passkey is added.
• Your recovery phrase, if you set one up, unlocks your key on any device. Keys set up from the Security page always come with one; a signer's first setup from a signing link can rely on the passkey alone.
• A passkey kept on a single device or security key is gone if that device is, so keep a second passkey or your recovery phrase.
• If you lose every passkey and your recovery phrase, sign in and reset your key from the Security page (Lost everything? Reset key, then type RESET). You get a new key and passkey; your old passkeys are removed, documents encrypted to the old key can no longer be opened with your account, documents waiting for your signature go back to their senders to release again, and Attest emails you that your key was reset.
• Protect your email account. A reset needs only a signed-in session, so whoever controls your mailbox could sign in and reset your key the same way, with no passkey or recovery phrase, and get a new key and passkey in your name. The reset email goes to that same mailbox, so your Attest account is as secure as your email account.

What a passkey proves, and what it doesn't

A passkey signature proves that the holder of that passkey approved that exact statement, after the device verified them. It doesn't identify a person by name: WebAuthn notes that "user verification does not give the Relying Party a concrete identification of the user". On Attest, each signature is made by a passkey registered to the signer's email address; Attest confirms control of the email address and the passkey, not a government ID.

Under the ESIGN Act, UETA and eIDAS, a passkey approval is an electronic signature, in the same category as a typed name or a click. Electronic signatures are recognized for most agreements in the United States (the ESIGN Act and UETA) and the European Union (eIDAS). Some documents, such as wills or certain notarized deeds, have special rules in many places: check yours. What a passkey changes is the evidence: why a passkey signature beats an email link compares the two.