Why Passkeys Don’t Work on Some Devices: Device-Level Limitations

Question

Passkeys fail on some devices because they depend on WebAuthn, operating systems, browsers, and secure hardware working together. Passkeys are not a standalone feature; they are a coordinated system involving the browser (client), authenticator (device), and server (relying party).

Devices fail passkey authentication when any layer is incomplete or inconsistent. Older operating systems lack platform authenticators like iCloud Keychain or Windows Hello. Browsers may implement WebAuthn differently or incompletely. Hardware limitations such as missing TPM or Secure Enclave prevent secure key storage.

Cross-device passkeys depend on cloud sync systems like Apple iCloud or Google Password Manager. When sync fails, passkeys become unavailable across devices.

Passkeys fail due to system-level fragmentation, not single-point bugs.
Reliable passkey authentication requires full stack support across device, OS, and browser.

Quick TL;DR

• Passkeys depend on WebAuthn, not just frontend implementation.

• OS, browser, and hardware must all support passkeys.

• Older devices fail due to missing secure hardware modules.

• Cross-device login depends on ecosystem sync (Apple/Google).

• Fallback authentication is mandatory for production systems.

What Are Passkeys (Deep Technical Context)

Passkeys are FIDO2 credentials built on WebAuthn and CTAP protocols. They replace passwords using asymmetric cryptography.

Each passkey includes:

• A public key stored on the server

• A private key stored inside a device authenticator

The private key never leaves the device. Authentication happens through cryptographic signatures.

WebAuthn defines how browsers interact with authenticators and servers.

Key Components

• Relying Party (Server) → verifies identity

• Client (Browser/OS) → mediates authentication

• Authenticator (Device) → stores keys and signs challenges

Passkeys are WebAuthn credentials stored in authenticators.
Authentication uses cryptographic signatures instead of passwords.

For full conceptual explanation:
https://mojoauth.com/blog/what-are-passkeys-and-how-they-work

How Passkeys Actually Work

Registration Ceremony

1. Server generates challenge

2. Browser calls navigator.credentials.create()

3. Authenticator generates key pair

4. Private key stored in secure hardware

5. Public key returned with attestation

6. Server stores public key

WebAuthn ensures keys are scoped to the domain.

Passkeys are origin-bound and cannot be reused across sites.

Authentication Ceremony

1. Server sends challenge

2. Browser calls navigator.credentials.get()

3. Authenticator signs challenge

4. User verifies identity (biometric/PIN)

5. Signed assertion returned

6. Server verifies signature

Authentication proves possession of private key without exposing it.

Authenticator Types (Critical for Failures)

1. Platform Authenticators

• Built into device

• Examples:

  • iCloud Keychain

  • Android Keystore

  • Windows Hello

2. Roaming Authenticators

• External devices

• Examples:

  • Security keys (YubiKey)

  • Phones via QR login

3. Multi-Device Passkeys

• Synced via cloud

• Stored across devices

Different authenticator types behave differently across devices.

OS-Level Support (Precise Reality, Not Marketing)

Apple Ecosystem

OS	Real Behavior
iOS 16+	Full passkey support
iOS 15	No native support
macOS Ventura (13)+	Full support
macOS Monterey	Limited

Important Constraints

• iCloud Keychain must be enabled for passkey storage and sync.

• User must be signed in with a valid Apple ID.

• Device must have passcode or biometric authentication enabled.

• Passkeys are only available on iOS 16+, iPadOS 16+, and macOS Ventura+.

• All devices must be part of the same Apple ecosystem for seamless sync.

Passkeys on Apple devices depend entirely on iCloud Keychain infrastructure.

Hidden Limitations

• Passkeys are tightly coupled to Apple’s ecosystem and account system.

• Cross-platform usage relies on QR-based fallback mechanisms.

• iCloud sync delays can cause passkeys to appear missing on new devices.

• Shared devices or multiple Apple IDs can break passkey availability.

• Enterprise restrictions may disable iCloud Keychain, blocking passkeys.

Apple passkeys work best within a fully aligned Apple ecosystem.
Cross-device reliability decreases outside Apple-controlled environments.

Android Ecosystem

OS	Real Behavior
Android 14+	Stable support
Android 9–13	Partial / fragmented
Android <9	Unsupported

Requirements

• Google Play Services

• Google Password Manager

• Device lock enabled

Hidden Problems

• OEM fragmentation (Samsung vs Pixel behavior differs)

• Inconsistent biometric APIs

Android passkey support varies by manufacturer and OS version.

Windows Ecosystem

OS Support and Reality

OS	Passkey Support
Windows 11 (22H2+)	Full support
Windows 10	Partial / inconsistent
Older versions	Not supported

Windows passkey support is strongest on Windows 11 with modern updates.

Important Constraints

• Windows Hello must be configured for passkey authentication.

• TPM 2.0 is required for secure key storage.

• Device must have PIN, fingerprint, or facial recognition enabled.

• Browser must support WebAuthn (Edge or Chrome recommended).

• User must allow credential storage at OS level.

Windows passkeys rely on Windows Hello as the platform authenticator.

Hidden Limitations

• Enterprise group policies can disable WebAuthn or Windows Hello.

• Some corporate devices restrict biometric or PIN-based login.

• TPM misconfiguration can silently break passkey registration.

• Older Windows builds lack proper WebAuthn integration.

• Cross-device passkey sync is weaker compared to Apple or Google ecosystems.

Windows passkey reliability depends heavily on enterprise configurations.
Corporate environments are a common source of passkey failures.

Browser-Level Behavior on Windows

• Microsoft Edge provides the most stable passkey experience.

• Google Chrome supports passkeys but depends on Windows Hello integration.

• Firefox has limited passkey UX and inconsistent support.

Browser choice significantly impacts passkey behavior on Windows.

Common Failure Scenarios

• Windows Hello not configured → passkey prompt never appears

• TPM disabled → passkey creation fails silently

• Corporate policy blocks WebAuthn → authentication fails

• Using outdated Windows 10 → inconsistent behavior

Most Windows passkey failures are caused by configuration, not code.

Practical Fixes

• Enable Windows Hello (PIN or biometrics)

• Ensure TPM 2.0 is active in BIOS

• Update to latest Windows 11 version

• Use Edge or latest Chrome

• Check enterprise policy restrictions

Correct configuration resolves most Windows passkey issues.

Linux Reality (Important Edge Case)

• No native passkey ecosystem

• Requires:

  • External authenticator

  • QR-based login

Linux lacks first-class passkey ecosystem support.

Browser Support (Detailed + Realistic)

Browser support for passkeys is based on WebAuthn implementation, but real-world behavior varies across platforms. A browser may support WebAuthn technically but still fail in certain device or ecosystem scenarios.

Browser support for passkeys is platform-dependent, not just version-dependent.

Supported Browsers and Versions

Browser	Minimum Version	Real-World Support
Chrome (Chromium)	108+	Stable, but OS-dependent
Safari	16+	Best on Apple devices
Edge	108+	Strong on Windows
Firefox	109+	Partial UX support

Google Chrome (Chromium Ecosystem)

Chrome provides the most widely used WebAuthn implementation across platforms.

• Full passkey support on Chrome 108+

• Relies on OS-level authenticators (Android, Windows Hello, macOS)

• Supports cross-device authentication via QR flow

Limitations

• Behavior varies between Android, Windows, and macOS

• Sync depends on Google Password Manager

• Older Chrome versions lack passkey UX

Chrome is consistent at API level but varies at platform level.

Safari (Apple Ecosystem)

Safari provides the most seamless passkey experience within Apple devices.

• Deep integration with iCloud Keychain

• Native biometric prompts (Face ID / Touch ID)

• Strong UX consistency across iPhone, iPad, and Mac

Limitations

• Limited outside Apple ecosystem

• Cross-platform flows rely on QR-based login

• Debugging WebAuthn issues is harder

Safari offers the best UX but is tightly locked to Apple ecosystem.

Microsoft Edge (Windows Ecosystem)

Edge is optimized for Windows and integrates directly with Windows Hello.

• Uses Windows Hello for authentication

• Stable WebAuthn implementation on Windows 11

• Works well with enterprise environments

Limitations

• Dependent on Windows Hello configuration

• Enterprise policies may restrict behavior

• Less flexible outside Windows ecosystem

Edge provides the most stable passkey experience on Windows.

Mozilla Firefox

Firefox supports WebAuthn but has slower adoption of passkey UX improvements.

• Basic WebAuthn support available

• Works with security keys and some platform authenticators

Limitations

• Limited passkey UI compared to Chrome/Safari

• Inconsistent cross-device support

• Slower updates for passkey features

Firefox support exists but is not fully optimized for passkeys.

Key Browser-Level Limitations

• WebAuthn APIs are implemented differently across browsers.

• Passkey UX flows vary significantly between browsers.

• Cross-device authentication behavior is inconsistent.

• Fallback handling differs across implementations.

Browser inconsistency is a major source of passkey failures.

Common Failure Scenarios

• Using outdated browser version → passkey prompt not triggered

• Browser does not detect platform authenticator → login fails

• Cross-device QR flow fails → authentication breaks

• Mixed browser environments → inconsistent user experience

Most browser-related passkey failures are due to version mismatch or platform differences.

Practical Fixes

• Always use latest browser version

• Prefer Chrome, Safari, or Edge for production

• Detect WebAuthn support before initiating login

• Provide fallback authentication methods

• Test across multiple browsers and devices

Testing across browser and OS combinations is critical for reliability.

Final Insight

Browsers do not implement passkeys in isolation.
They depend on operating systems and hardware for actual authentication.

Browser support alone does not guarantee passkey success.
Passkeys work only when browser, OS, and hardware are aligned.

Mobile Passkey Flows

Same Device (Native Flow)

1. User clicks login

2. OS prompts biometric

3. Authenticator signs challenge

4. Login completes

Cross-Device (Hybrid Transport)

1. Desktop shows QR

2. Mobile scans QR

3. Mobile signs challenge

4. Desktop session established

This uses FIDO Cross-Device Authentication (CDA)

Where It Breaks

• Bluetooth disabled

• Devices not nearby

• Ecosystem mismatch

Cross-device passkeys depend on proximity and ecosystem trust.

Why Passkeys Fail

Passkeys fail when any layer in the authentication stack is misaligned. Passkey authentication depends on coordination between the brows