Are Passkeys Really Multi-Factor Authentication?

A familiar objection to passkeys goes like this: “It all happens on my phone, so that is only one factor—not real MFA.” The intuition is understandable. Multi-factor authentication has been sold for years as “password plus something on another device.”

The UK NCSC comparison of traditional credentials and FIDO2 for personal use is clearer: a FIDO2 credential used with user verification is treated as equivalent to multi-factor authentication. The factors are the cryptographic key you possess and the PIN or biometric that unlocks it—not a requirement that those factors live on separate gadgets.

The objection: “same device, so not two factors”

People hear “multi-factor” and picture two separate things: a password typed somewhere, then a code or push on a phone. When a passkey lives on that same phone and unlocks with Face ID or a device PIN, it feels like a single gesture on a single device—so “not MFA.”

That objection conflates two different ideas: how many authentication factors are involved, and how many physical devices are involved. Standards care about the former. Everyday marketing often implied the latter.

What “factors” actually mean

Authentication factors are categories of evidence, not a checklist of separate gadgets:

• Something you have — a device, security key, or cryptographic credential you control.
• Something you know — a password, PIN, or other secret.
• Something you are — a biometric such as a fingerprint or face match.

How passkeys map to those factors

A passkey is a FIDO2 / WebAuthn public-key credential. The private key stays on the authenticator (phone, laptop, or hardware key). Proving possession of that key is something you have. When the relying party requests user verification, the authenticator also requires a local PIN or biometric before it will sign— something you know or something you are.

Together, that is multi-factor authentication in the sense used by the NCSC and aligned with how FIDO describes user verification. You are not “just tapping Approve”; the cryptographic proof only proceeds after local UV succeeds.

For a practical walkthrough of registration and day-to-day use, see our passkeys overview.

The same-device critique cuts both ways

If “two factors on one phone” disqualified MFA, most real-world setups would fail the test. Password managers, SMS codes, authenticator apps, and push approvals routinely live on the same handset people use to browse.

A password typed on the phone plus an SMS that arrives on that phone is still described as MFA—because the factors are different kinds of evidence, even when the delivery channel is the same device. Passkeys with user verification follow the same logic, with stronger phishing resistance than SMS or TOTP.

When user verification matters

FIDO2 can also run without user verification in some flows (presence-only, such as a simple touch). In those cases you mainly prove possession of the authenticator. The MFA-equivalent claim the NCSC makes for personal-use FIDO2 credentials assumes user verification is in play when the site requests it.

In practice, major consumer platforms request UV for passkey sign-in: unlock with biometrics or device PIN, then the authenticator signs the challenge. Prefer sites that treat passkeys as a primary, UV-backed login—not as a weak “confirm once” checkbox with no local gate.

What this means for personal accounts

Do not dismiss passkeys as “single factor” because they feel like one unlock. Prefer them for email, banking, cloud, and other high-value accounts where they are offered. They combine possession of a private key with local user verification, and they bind the login to the real origin—unlike codes that can be phished through a proxy.

Keep strong unique passwords and traditional MFA only where passkeys are not yet available. When both exist, the phishing-resistant passkey path is the better default for personal use.

Bottom line

Multi-factor means multiple kinds of evidence—not necessarily multiple devices. A passkey with user verification is something you have plus something you know or are. That is why the NCSC treats FIDO2 with UV as MFA-equivalent for personal use, and why “it is all on my phone” is not a sound reason to stick with passwords and SMS.