# How passkeys replace passwords

> A process map exported from forks.world (https://forks.world). Author: Brian. Source: https://forks.world/p/cmv21nqyx001gl206hj3qtohb
> It describes who does what, in what order, and with which technology. Read the plain-language sections first; the JSON at the end is the exact, complete data.

## Summary

- 11 steps across 1 layer
- Persona: You
- Technology / systems: Your phone or laptop, The website

## How to read this file

- A process is made of **layers**. The main layer is the top level; any step of kind `subprocess` opens a detail layer with its own lanes and steps.
- **Lanes** are either persona (people/roles) or technology (systems). Each step belongs to one lane; `using` lists tools a person uses for that step.
- Step kinds: `start`, `task`, `decision` (its arrows carry the answer as a label), `subprocess`, `end`.

## How passkeys replace passwords

Lanes:
- You: person / role (id `you`)
- Your phone or laptop: technology / system (id `phone`)
- The website: technology / system (id `site`)

Steps, in the order they run:

1. **You create an account and choose passkey** [start; You; id `k1`]
   - then Your device makes two linked keys: one stays on the device, one is public
2. **Your device makes two linked keys: one stays on the device, one is public** [task; Your phone or laptop; id `k2`]
   - then The website stores only the public key
3. **The website stores only the public key** [task; The website; id `k3`]
   - then Later you open the site and tap sign in
4. **Later you open the site and tap sign in** [task; You; id `k4`]
   - then It sends a random challenge
5. **It sends a random challenge** [task; The website; id `k5`]
   - then You prove it is you with your face or fingerprint
6. **You prove it is you with your face or fingerprint** [task; Your phone or laptop; id `k6`]
   - then The private key signs the challenge
7. **The private key signs the challenge** [task; Your phone or laptop; id `k7`]
   - then The site checks the signature with the public key
8. **The site checks the signature with the public key** [task; The website; id `k8`]
   - then Does it match?
9. **Does it match?** [decision; The website; id `k9`]
   - if "Yes" go to You are in, with no password to type or steal; if "No" go to Sign in fails
10. **You are in, with no password to type or steal** [end; You; id `k10`]
11. **Sign in fails** [task; The website; id `k11`]
   - then Later you open the site and tap sign in

```mermaid
flowchart LR
  subgraph l_you["You"]
    n_k1(["You create an account and choose passkey"])
    n_k4["Later you open the site and tap sign in"]
    n_k10(["You are in, with no password to type or steal"])
  end
  subgraph l_phone["Your phone or laptop"]
    n_k2["Your device makes two linked keys: one stays on the device, one is public"]
    n_k6["You prove it is you with your face or fingerprint"]
    n_k7["The private key signs the challenge"]
  end
  subgraph l_site["The website"]
    n_k3["The website stores only the public key"]
    n_k5["It sends a random challenge"]
    n_k8["The site checks the signature with the public key"]
    n_k9{"Does it match?"}
    n_k11["Sign in fails"]
  end
  n_k1 --> n_k2
  n_k2 --> n_k3
  n_k3 --> n_k4
  n_k4 --> n_k5
  n_k5 --> n_k6
  n_k6 --> n_k7
  n_k7 --> n_k8
  n_k8 --> n_k9
  n_k9 -->|"Yes"| n_k10
  n_k9 -->|"No"| n_k11
  n_k11 --> n_k4
```

## Full data (JSON)

```json
{
  "title": "How passkeys replace passwords",
  "maps": {
    "m_root": {
      "id": "m_root",
      "lanes": [
        {
          "id": "you",
          "name": "You",
          "type": "person"
        },
        {
          "id": "phone",
          "name": "Your phone or laptop",
          "type": "system"
        },
        {
          "id": "site",
          "name": "The website",
          "type": "system"
        }
      ],
      "steps": [
        {
          "id": "k1",
          "kind": "start",
          "lane": "you",
          "next": [
            {
              "to": "k2"
            }
          ],
          "uses": [],
          "label": "You create an account and choose passkey"
        },
        {
          "id": "k2",
          "kind": "task",
          "lane": "phone",
          "next": [
            {
              "to": "k3"
            }
          ],
          "uses": [],
          "label": "Your device makes two linked keys: one stays on the device, one is public"
        },
        {
          "id": "k3",
          "kind": "task",
          "lane": "site",
          "next": [
            {
              "to": "k4"
            }
          ],
          "uses": [],
          "label": "The website stores only the public key"
        },
        {
          "id": "k4",
          "kind": "task",
          "lane": "you",
          "next": [
            {
              "to": "k5"
            }
          ],
          "uses": [],
          "label": "Later you open the site and tap sign in"
        },
        {
          "id": "k5",
          "kind": "task",
          "lane": "site",
          "next": [
            {
              "to": "k6"
            }
          ],
          "uses": [],
          "label": "It sends a random challenge"
        },
        {
          "id": "k6",
          "kind": "task",
          "lane": "phone",
          "next": [
            {
              "to": "k7"
            }
          ],
          "uses": [],
          "label": "You prove it is you with your face or fingerprint"
        },
        {
          "id": "k7",
          "kind": "task",
          "lane": "phone",
          "next": [
            {
              "to": "k8"
            }
          ],
          "uses": [],
          "label": "The private key signs the challenge"
        },
        {
          "id": "k8",
          "kind": "task",
          "lane": "site",
          "next": [
            {
              "to": "k9"
            }
          ],
          "uses": [],
          "label": "The site checks the signature with the public key"
        },
        {
          "id": "k9",
          "kind": "decision",
          "lane": "site",
          "next": [
            {
              "to": "k10",
              "label": "Yes"
            },
            {
              "to": "k11",
              "label": "No"
            }
          ],
          "uses": [],
          "label": "Does it match?"
        },
        {
          "id": "k10",
          "kind": "end",
          "lane": "you",
          "next": [],
          "uses": [],
          "label": "You are in, with no password to type or steal"
        },
        {
          "id": "k11",
          "kind": "task",
          "lane": "site",
          "next": [
            {
              "to": "k4"
            }
          ],
          "uses": [],
          "label": "Sign in fails"
        }
      ],
      "title": "How passkeys replace passwords",
      "parent": null
    }
  }
}
```