Skip to main content
Version 0.3Draft

Passwordless and passkey UX

Overview​

Passkeys are WebAuthn/FIDO2 credentials that replace or complement passwords. When a LuxID user has enrolled a passkey, they can sign in using device biometrics (Face ID, Touch ID, fingerprint reader, Windows Hello, or a PIN) without typing a password.

As a partner application, you do not implement passkey logic yourself. Passkeys are managed by LuxID at https://login.luxid.lu. However, you need to understand the user experience so you can:

  • Set accurate expectations in your application's onboarding and help content.
  • Handle fallback flows gracefully when passkeys are unavailable.
  • Avoid confusing users who encounter a passkey prompt for the first time.

For the technical feature reference, see Passwordless and passkeys.

What a passkey is - and is not​

Passkeys are widely misunderstood. Users who encounter the prompt for the first time often ask "where is my password?" or "why is it asking for my fingerprint on a banking site?"

The core concept to communicate clearly:

A passkey is a digital key stored on your device. You unlock it with your fingerprint, face, or PIN - the same way you unlock your phone. It is not a password you can type on another device.

Key differences from passwords​

PasswordsPasskeys
Typed by the userUnlocked with biometrics or PIN
Can be shared or reusedDevice-bound by design
Can be stolen from a server breachNo secret leaves the device
Can be phishedCannot be phished (bound to login.luxid.lu)
Work on any deviceRequire enrolment on each device (or cross-device flow)

What "device-bound" means for users​

A passkey created on a user's iPhone is stored in that iPhone's Secure Enclave (or synced to iCloud Keychain if the user has iCloud Keychain enabled). If the user tries to sign in on a different device, they cannot use the passkey directly - they need the cross-device QR flow (see below) or another authentication method.

note

This is a feature, not a bug. It is worth explaining this to users in your help content so they are not confused when the passkey prompt does not appear on a new device.

User verification requirement​

LuxID requires user verification for every passkey assertion - not only possession of the device, but also active proof of ownership via a local authenticator (PIN, fingerprint, face scan, or equivalent). This is the stricter of the two WebAuthn user-verification modes (required rather than preferred).

In practice, this means:

  • The user must complete a biometric or PIN challenge on their device at each sign-in, even if the device was recently unlocked.
  • A passkey that was set up on a device without a screen lock or PIN will not satisfy LuxID's requirement and cannot be used for sign-in.
  • Some older or simpler devices may not be compatible. If a device cannot perform user verification (for example, a basic FIDO2 security key without a PIN configured, or a device where the platform authenticator is disabled), LuxID will not accept the passkey assertion and will fall back to the password flow.

Messaging the requirement to users​

If a user contacts your support team because their passkey does not work on a particular device, the most common cause is that user verification is not available on that device. Frame this for users as a security feature:

"For your security, LuxID asks you to confirm your identity with a fingerprint, face scan, or PIN every time you use a passkey. If your device does not support this, you can sign in with your password instead."

This prevents users from interpreting an incompatible device as a bug in your application or in LuxID.

Browser compatibility​

Passkey support varies by browser and operating system. LuxID's Universal Login handles detection automatically: if the browser does not support WebAuthn, the passkey option is not shown, and the user falls back to password + MFA.

Current support status (as of may 2026)​

BrowserPlatformPasskey support
Safari 17+macOS, iOSFull support, syncs via iCloud Keychain
Chrome 108+macOS, Windows, AndroidFull support, syncs via Google Password Manager
Firefox 122+macOS, WindowsFull support (no sync via Firefox currently)
Edge 108+WindowsFull support, syncs via Microsoft account
Samsung Internet 23+AndroidFull support

Platform authenticators​

In addition to browser-level support, passkeys require a platform authenticator:

PlatformAuthenticator
iOS / macOSFace ID, Touch ID, or device PIN
AndroidFingerprint, face unlock, or PIN
WindowsWindows Hello (fingerprint, face, or PIN)

If neither a compatible browser nor a platform authenticator is available, passkeys are not offered and the user signs in with password + MFA.

Sign-in flow UX​

LuxID uses an email-first flow. The user enters their email address on the first screen. What happens next depends on whether a passkey is configured for that account.

When a passkey is configured​

After the user types their email and continues, LuxID detects that a passkey is enrolled for that account and presents a choice screen with two options:

  • "Login with Passkey" - the primary button, styled prominently
  • "Login with Password" - the secondary option, less prominent

The user is not sent directly to the passkey prompt without warning. The choice screen gives users who are on an incompatible device, or who prefer the password flow, a clear route to the alternative. Your help content and onboarding copy should reflect this: users do not lose access to their account if their passkey is unavailable.

When no passkey is configured​

If the account has no passkey enrolled, the choice screen is not shown. LuxID presents the password entry field directly after the email step.

Full sign-in sequence (passkey configured)​

The user's end-to-end experience when they choose the passkey path: click "Sign in with LuxID", enter email, tap "Login with Passkey", confirm with face or fingerprint, and they are back in your application. No password. No OTP code.

Cross-device passkey UX​

A user may want to sign in on a device where they have not enrolled a passkey - for example, signing in on a colleague's laptop using a passkey stored on their own phone.

LuxID supports the cross-device passkey flow (CTAP2 / hybrid transport):

  1. The user selects "Use a passkey from another device" on the sign-in screen.
  2. LuxID displays a QR code.
  3. The user scans the QR code with their phone (where the passkey is stored).
  4. The phone prompts for biometric confirmation.
  5. The laptop receives the assertion and completes sign-in.

This flow requires Bluetooth to be enabled on both devices and is handled entirely by the browser and platform - no additional implementation is needed on the partner application side.

When to mention this in your help content​

If your application is frequently used on shared or public computers, include a short note in your help documentation:

"If your passkey is on your phone, you can still use it to sign in on another computer. On the LuxID sign-in screen, choose 'Use a passkey from another device' and scan the QR code with your phone."

Fallback when a passkey fails or is unavailable​

LuxID always provides a password fallback. If the passkey prompt fails (user dismisses it, biometric fails, or device is incompatible), the user can:

  • Click "Use your password instead" to proceed with a standard password entry.
  • Complete MFA with their enrolled second factor (OTP, TOTP, or LuxTrust) as normal.
caution

Your application should never assume that passkey authentication will always succeed and should not display messaging that implies it is the only option.

Fallback flow​

The user may fall back to password from either the choice screen (selecting "Login with Password") or after a failed passkey assertion:

User education guidance​

If your application includes onboarding, a security settings page, or a help centre, consider the following guidance for passkey-related messaging.

Introduce passkeys positively​

Avoid framing passkeys as a technical novelty. Frame them as a convenience and security improvement:

"Sign in faster with a passkey. Instead of a password, use your fingerprint or face to sign in to your LuxID Account - no typing required."

Set expectations about device binding​

"Your passkey is stored on this device. If you sign in on a different device, you will need to use your password or scan a QR code from your phone."

Encourage keeping a backup method​

"We recommend keeping your password set up alongside your passkey. If you switch devices or your device is unavailable, you can still sign in with your password."

TopicURL
Passkeys help (English)https://www.luxid.lu/en/resources/passkeys (opens in a new tab)
Passkeys help (French)https://www.luxid.lu/fr/resources/passkeys (opens in a new tab)
Passkeys help (German)https://www.luxid.lu/de/resources/passkeys (opens in a new tab)
Passkeys help (Luxembourgish)https://www.luxid.lu/lb/resources/passkeys (opens in a new tab)

Match the URL language path to the user's current interface language.

Updated 2026-07-03
On this page