August 2026 Summaries

Passkeys have become a mainstream authentication option, with an estimated 5 billion active credentials worldwide, broad platform support, and growing organizational deployment, shifting the decision from whether to adopt passwordless login to which method best fits a product’s risks and users. Compared with passwords, magic links, and email or SMS one-time codes, passkeys provide the strongest phishing resistance because they are origin-bound cryptographic credentials rather than reusable secrets, while also improving login speed, success rates, and potentially support costs. However, they require careful handling of account recovery, cross-ecosystem device use, enterprise device management, and user education, particularly for audiences unfamiliar with the technology. Magic links and OTPs remain practical lower-effort alternatives for low-stakes products, early-stage teams, and nontechnical audiences, though they remain vulnerable to real-time phishing; passwords are best retained only as a fallback. Organizations are encouraged to introduce passkeys alongside existing methods rather than forcing immediate migration, and to use established WebAuthn SDKs or providers instead of implementing security-critical passkey ceremonies from scratch unless authentication is a core competency.

Passkeys replace passwords’ shared-secret model with public-key cryptography: a device stores a nonextractable private key in secure hardware while the server retains only its matching public key. Built on WebAuthn, the browser API, and FIDO2, which also includes the protocol for communicating with authenticators, passkeys authenticate users by signing fresh server-issued challenges rather than transmitting reusable credentials. Their origin binding prevents credentials registered for one domain from being used on phishing sites, while one-time challenge signatures cannot be replayed if intercepted. Synced passkeys improve usability and device recovery by storing encrypted credentials in cloud keychains, whereas device-bound passkeys on hardware security keys provide stronger physical assurance but require separate recovery planning. The technology is now natively supported across major platforms, and the text positions it as a practical authentication option for developers, while noting that secure recovery methods and protection of synced-keychain accounts remain important considerations.

A complete self-hosted passkey implementation for a Next.js App Router application can use SuperTokens’ WebAuthn and Session recipes to handle relying-party responsibilities such as challenge generation, attestation validation, public-key storage, signature verification, and session issuance without sending credentials to a third-party identity provider. The setup centers on shared domain configuration, backend and frontend SDK initialization, and a catch-all API route under `/api/auth` that exposes SuperTokens authentication endpoints. Client-side helper methods manage registration and sign-in ceremonies by invoking the browser’s WebAuthn APIs while the SuperTokens Core verifies credentials and creates sessions; the SDK also avoids common binary-data serialization issues. Correct origin and relying-party ID configuration is essential because passkeys are bound to domains, while cross-device use is largely managed by browsers and operating systems through synced or hybrid credentials. The guide emphasizes planning recovery before launch through fallback factors, email-based recovery tokens, or multiple registered authenticators to prevent permanent lockouts. It also describes a gradual migration strategy in which passkeys coexist with password authentication and are linked to the same user account, allowing teams to adopt passkeys without immediately removing existing login methods.

SuperTokens and Hanko are open-source, self-hostable authentication platforms with managed cloud offerings, but they target different needs: SuperTokens provides a broad authentication stack for B2B SaaS, while Hanko is centered on passkey-first, passwordless consumer experiences. Hanko’s FIDO2-certified WebAuthn infrastructure and standalone Passkey API allow passkeys to be added to existing authentication systems, whereas SuperTokens includes passkeys among broader features such as multi-tenancy, role-based access control, enterprise SAML SSO, rotating refresh tokens, and token theft detection. Their licensing differs significantly, with SuperTokens using permissive Apache 2.0 licensing and Hanko using AGPL v3 for its backend alongside MIT-licensed frontend components, meaning modified self-hosted Hanko backends used as network services must generally have those modifications published. Hanko Cloud is generally less expensive per monthly active user, offers a larger free tier and a startup program that can provide up to one million free MAUs for qualifying companies, while SuperTokens may incur additional costs for features such as MFA and account linking. SuperTokens offers its strongest prebuilt interface support for React and Next.js, while Hanko Elements use framework-independent Web Components. The comparison concludes that SuperTokens is better suited to organizations needing comprehensive B2B identity capabilities and permissive licensing, Hanko is better for passkey-focused and cost-sensitive B2C applications, and the two can be combined by using Hanko’s Passkey API alongside SuperTokens’ core authentication platform.