Passkeys, a Light Introduction to Improving Blockchain’s UX

Blockchain technology is often recognized and celebrated for its inherent features of transparency, security, efficiency, and decentralization, as well as its beneficial use cases, including the potential to bring financial opportunities to underserved and underbanked populations — and this is all true. There are numerous real-world examples of blockchain making a positive impact on the world. One compelling instance is detailed in this case study, highlighting how the crypto wallet Decaf brings financial opportunities to small businesses in Latin America.

However, great tech and solid use cases don’t always equal adoption. A famous quote from the film Field of Dreams states: “If you build it, they will come,” implying that building something valuable will naturally attract users. Well, blockchain is here! But people aren’t necessarily using it. Only around 300 million people actually use blockchain, which is under 4% of the global population. Compare that to Web2, which has over 5 billion users.

So, we know that blockchain is valuable and has a ton of potential, yet it’s still struggling to gain widespread adoption. Why, you might ask? Well, one primary reason is that the end-user experience is unfamiliar, clunky, and intimidating, especially for new users and those coming from Web2.

Individuals typically first interact with Web3 and blockchain through a centralized, custodial service like Coinbase or Binance, which are essentially Web2 platforms that give users access to Web3 assets. Although these services are fairly user-friendly, users don’t have full control over their assets or private keys (defined below).

Using non-custodial wallets instead gives users full control over their assets, private keys, and transactions but introduces a more complex user experience. Let’s go through a typical user journey with a non-custodial service to showcase some of these issues.

An individual opens a crypto “wallet” to create accounts, obtain assets, access their assets, and perform various functions. There are many different crypto wallets out there — on Stellar alone, there’s LOBSTR, xBull, Vibrant, Freighter, Albedo, Beans, the list goes on. And each of these non-custodial services requires every individual to create an account consisting of a public key and a private key (also called a secret key), which together comprise a keypair and, depending on the wallet, a 24-word passphrase. When a user receives their keypair, it is typically accompanied by an ominous warning that states something like, “DO NOT LOSE YOUR SECRET KEY OR PASSPHRASE. If you do, you will lose your assets FOREVER!”

With that unfamiliar login experience and daunting admonition, many new users have probably already been scared off. Using secret keys to sign transactions and long passphrases to access accounts creates a complex user experience with severe security concerns. Not only must you store your secret key somewhere safe and private, but you also need it to be accessible, as a secret key is required to authorize every single transaction on the network. And if you have accounts with multiple wallets, you’re storing multiple keypairs. It’s confusing and cumbersome, even if you’re a frequent blockchain user.

Thankfully, most blockchain developers realize these usability issues and are exploring various advancements to improve the user experience and make the technology more accessible to increase adoption. One such feature is passkeys, a more secure and user-friendly authentication method that enables users to access accounts and sign transactions.

Let’s get into passkeys' history a bit before jumping to how passkeys work in blockchain specifically.

Passkeys are not a new technology, they have already been widely adopted in Web2 and are implemented into various services like Amazon, WhatsApp, LinkedIn, PayPal, and more. A passkey is a robust, secure, and user-centric encryption method that authenticates users, allowing them to access services, systems, and applications without inputting a password (or secret key or passphrase in blockchain).

For many decades, passwords have been the primary method of user authentication. However, they come with their fair share of security and usability issues. Individuals have to manage and remember multiple passwords, and often, they reuse passwords across various platforms with only slight variations. When a user inputs their password for authentication, it transfers from the user’s device to a server, which exposes it to potential interceptions by attackers. If a bad actor obtains the password, they may be able to use it to access the user’s other accounts.

Passkeys address these issues by allowing users to sign up and authenticate without relying on passwords. Passkeys are created using the WebAuthn API, which is widely supported by modern browsers and operating systems. Passkeys are encrypted keypairs securely stored on the user’s device and can be accessed using biometrics or a device PIN. Additionally, they are domain-specific, meaning a passkey only works with its intended website. This mechanism checks the website's domain against the passkey's intended domain, helping protect users from phishing and malicious sites.

Passkeys significantly improve authentication and combine enhanced security with seamless usability. So, of course, they are also being adopted in Web3!

Passkeys in Web3 function similarly to Web2 and offer a more familiar, secure, and simple user experience by abstracting away keypair and passphrase management.

Before we get into how passkeys work, let’s define a few key components:

• User: the individual interacting with the decentralized application (dapp).
• Dapp: the frontend interface for the blockchain service that the user is interacting with.
• Device: what the user is using to interact with the dapp (e.g., a smartphone or computer).
• Smart wallet: a smart contract that acts as the user’s account; this replaces the typical public and private keys we are familiar with in blockchain. Smart wallets can rely on passkeys for authentication and enable more programmable account behaviors.
• Passkey: a cryptographic public and private keypair generated using the secp256r1 elliptic curve that is securely generated and stored on a device used to authenticate users. Passkeys are generated through the WebAuthn API and accessed using existing biometric systems or a device PIN.

Let’s combine these components into an example to show how passkeys work under the hood. The process is split into two main actions: passkey generation and using a passkey for transaction authorization.

In our scenario, JimBob wants to interact with the passkey-enabled dapp, Ye Olde Guestbook (a real dapp built by SDF Developer Advocate Elliot Voris), with his smartphone.

Passkey generation:

1. JimBob goes to the Ye Olde Guestbook dapp on his phone and clicks the “Signup” button;
2. His phone asks him if he would like to create a passkey on his device to sign into and interact with the dapp;
3. JimBob accepts and authenticates himself locally using the existing fingerprint biometrics stored on his phone;
4. His phone generates a public key and a private key using the secp256r1 elliptic curve, which are securely tied to both his device (the phone) and the service’s domain (ye-olde-guestbook.vercel.app) — this keypair is the passkey;
5. JimBob’s phone communicates with the blockchain to set up a smart wallet, registering the passkey’s public key as an authentication method for the wallet.

Using a passkey for transaction authorization:

1. JimBob wants to sign the Ye Olde Guestbook dapp on his phone using his smart wallet;
2. The dapp sends a challenge to JimBob’s phone, which must be signed to authorize the action;
3. JimBob verifies his identity locally by using fingerprint biometrics; the phone then accesses the private key associated with the passkey registered for that dapp and device;
4. JimBob’s phone cryptographically signs the challenge using the passkey’s private key and sends the signed challenge back to the dapp (note that the private key never leaves JimBob’s device);
5. The dapp adds the signed challenge to the transaction so it can be used for authentication once the transaction is submitted to the network;
6. The blockchain network validates the signature using the corresponding public key registered during setup to confirm the transaction’s authenticity;
7. Once verified, the transaction is processed, added to the blockchain, and JimBob can perform the action.

Although these steps seem complex, the user experience is actually quite simple. All JimBob does is sign up for the application with his fingerprint and then verify his identity with his fingerprint again to perform the desired action. The user experience is quick and seamless without sacrificing security. JimBob might not even know he’s interacting with a blockchain.

Passkey support came pretty late in the game for some blockchains already set in their ways. This gives Stellar an advantage because even though the Stellar blockchain is mature (it launched in 2014), it only gained smart contract capabilities on February 20th, 2024, when the Soroban smart contract platform launched on the network as part of Protocol 20. Soroban being built from scratch and more recently means Stellar can address known blockchain problems at the outset (another example is the implementation of state archival to address state bloat; learn more by watching SDF’s Garand Tyson’s presentation at Meridian 2024).

When implementing new features and updates on a blockchain, backward compatibility is a key consideration, and developers must ensure that new versions of the technology can interact with applications, smart contracts, and data created under previous versions. This can be difficult to address, especially when the blockchain has been around for a while. Often, third-party tools or layer 2 solutions are used instead, which introduces extra layers of computation that can increase latency and cost.

Conversely, on Stellar, passkey support is built directly into the protocol. On June 18th, 2024, Stellar network validators voted to upgrade the network to Protocol 21, which introduced native support for secp256r1 verification (the signature curve that supports passkeys) in smart contracts. Features integrated directly on the protocol level are optimized for speed and resource usage. Native features are also inherently compatible with the rest of the blockchain ecosystem, which makes it easier for developers to build interoperable tools and services.

The use of passkeys in blockchain is a huge step forward in user adoption. However, it’s just one step! Smart wallets have many more opportunities to improve the user experience, security, and functionality beyond traditional cryptocurrency wallets.

Stellar Development Foundation (SDF) engineers, along with the ecosystem, are working hard on a smart wallet interface for Stellar that will include exciting features, such as passkeys as signers (as we’ve talked about), multi-sig, Ed25519 signers, signer limits, policy signers, and more. There’s a lot to talk about with smart wallets, so keep your eyes open for more information as we get into 2025!

In the meantime, take a look at some of the really cool passkey-powered and passkey-related projects already being built for the Stellar network.

Passkey Kit: a client- and server-side SDK tool for creating and managing Stellar smart wallets, intended to be used with…

Launchtube: a service that abstracts away many complexities associated with smart contract transaction submission, including the need to manage transaction simulation, fees, and sequence numbers.

KALE: a proof-of-teamwork Stellar asset that can be created by planting, working, and harvesting through a smart contract. View the GitHub repo here.

Passkeys and smart wallets bring a whole lot of exciting capabilities to the Stellar network. Play around with them and share your findings in the #passkeys channel in the Stellar Dev Discord!