Lion Cipher Lab
Set up passwordless login with passkeys on your own accounts
- Identity & Access Management
- Beginner
- ~30-40 min
- Free · no account required
Why it matters
Passwords are the weakest part of almost everyone's online security: they get reused, leaked in company breaches, guessed, and -- most dangerously -- typed into fake login pages that look exactly like the real thing (phishing). A passkey removes that whole class of problem. Instead of a secret you know and can be tricked into revealing, a passkey is a cryptographic key pair created on your device: a private half that never leaves your phone or laptop, and a public half the website keeps. You prove who you are by unlocking the private key with your fingerprint, face, or PIN, and your device…
What you'll learn
- what a passkey is and how it differs from a password
- public-key cryptography in plain language (private key vs public key)
- why passkeys are phishing-resistant (domain binding)
- enrolling a passkey on a real account (Google / GitHub / Microsoft)
- the FIDO2 / WebAuthn registration and sign-in flow (the 'ceremony')
- synced vs device-bound passkeys
- registering a backup passkey so you are never locked out
- recognizing when to reach for a passkey over a password or SMS code
Steps in this lab
- What a passkey is, in one plain paragraph
- Why passwords are the problem being solved
- The one idea underneath it all: a key PAIR
- Why a passkey cannot be phished: it is tied to the real site
- Pick one account and open its security settings
- Enroll the passkey -- what each prompt means
- Register a BACKUP so you can never be locked out
- Sign in with your passkey and watch the flow
- What you just did -- and where to take it