Answer

What is a passkey and can a PWA use one?

Short answer

A passkey is a phishing-resistant credential built on the WebAuthn standard that replaces passwords: it is a cryptographic key pair, unlockable with the device’s biometric sensor or PIN, that can sync across a user’s devices via their platform account (Apple iCloud Keychain, Google Password Manager). A PWA can offer passkey sign-in using the same navigator.credentials API as any website — no native app is required.

By InstantPWA engineering·Reviewed July 25, 2026

Why passkeys are more secure

Because the private key never leaves the device and the credential is bound to the exact origin, passkeys cannot be phished or reused on a fake login page the way passwords can.

Cross-device sync

Passkeys created on one device typically sync to a user’s other devices through their platform account, and can also be used cross-device by scanning a QR code.

Implementation

Uses the same WebAuthn navigator.credentials.create() and .get() calls as biometric login, with server-side support for the WebAuthn ceremony.

Sources

FIDO Alliance — Passkeys

Can a PWA use Face ID or Touch ID?

Yes. The Web Authentication API (WebAuthn) lets a PWA prompt for the device’s built-in biometric authenticator — Face ID and Touch ID on Apple devices, Windows Hello on PC, or a fingerprint sensor on Android — to register or verify a user without ever handling the raw biometric data, which stays on-device. It is widely supported across modern Chrome, Safari, Edge and Firefox.

What is a PWA?

A PWA (Progressive Web App) is a regular website that meets three technical criteria — HTTPS, a Web App Manifest and a service worker — so browsers let visitors install it on their home screen. Once installed, it launches like a native app, works offline and can send push notifications.

What is the Idle Detection API?

The Idle Detection API lets a page detect, with the user’s permission, whether they have been idle (no keyboard/mouse/touch activity) for a specified threshold or have locked their screen — commonly used by chat and collaboration apps to automatically show an "away" status. It requires an explicit permission prompt and is supported on Chromium browsers only.

What is the Web Locks API for?

The Web Locks API lets scripts across multiple tabs, workers or a service worker of the same origin coordinate exclusive or shared access to a named resource, so only one context runs a given operation at a time — for example, preventing two open tabs of a PWA from both triggering the same background-sync network request simultaneously.

What is the app install banner (mini-infobar)?

The mini-infobar is a small automatic prompt Chrome for Android can show at the bottom of the screen once a site meets install criteria and engagement heuristics, offering a one-tap install without opening the browser menu. Developers can call preventDefault() on the beforeinstallprompt event to suppress it and instead show their own custom "Install" button, triggering the native dialog later at a more relevant moment.