Design passwordless login with passkeys
PremiumSecurity systemEasy
- WebAuthn
- Passkeys
- FIDO2
Quick answer
This security system interview question asks you to design passwordless login with passkeys. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design passwordless login with passkeys for a shopping website and its mobile apps, like the 'sign in with a passkey' option many sites now offer. Users sign in with a fingerprint, face or device PIN instead of a password. The hard parts are checking each WebAuthn step correctly and keeping account recovery as strong as the passkey.
A passkey is a public-private key pair made by the user's device or password manager for one website. The private key stays in the authenticator (or is synced end-to-end encrypted by the platform), and the server stores only the public key. Today the site uses passwords plus SMS codes, and phishing is the top cause of account takeover.
What must the system do?
- Create a passkey: A signed-in user adds a passkey after proving who they are, and can have several (phone, laptop, security key).
- Sign in without a password: The user picks a passkey from browser autofill or a button and signs in with one biometric or PIN step.
How well must it do it?
- Phishing resistance: A look-alike site must not be able to use a passkey for this site.
- No shared secrets: A leak of the server database gives an attacker nothing they can sign in with.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- WebAuthn
- Passkeys
- FIDO2
- Phishing resistance
- Challenge response
- Conditional UI
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design passwordless login with passkeys and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Easy, so it suits engineers who are new to security system interviews. It is also a good warm-up before harder questions.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team