Passkeys are the most secure way to sign into MAIA. Here's how they work and why they're stronger than passwords.
How Passkeys Work
When you set up a passkey, your device creates a unique key pair — two mathematically linked keys:
- Private key — stays on your device. It is never sent to MAIA, never uploaded, never shared. It's protected by your device's biometric lock (Face ID, Touch ID, fingerprint, or Windows Hello).
- Public key — stored by MAIA. This is the only thing MAIA keeps. It can verify your identity but cannot be used to impersonate you.
At login, MAIA sends your device a random challenge. Your device signs that challenge with the private key (after verifying your biometric). MAIA checks the signature against the stored public key. If it matches, you're in.
Why Passkeys Are Stronger Than Passwords
- Phishing-resistant. The credential is bound to
app.maiaos.ai— a fake site at a different URL literally cannot trigger it. The browser enforces this, not you. - No password to steal. There's no secret string stored on a server that an attacker could extract from a database breach.
- No password to reuse. If you use the same password on another site that gets breached, your MAIA account is still safe — there's no password to try.
- Biometric verification. Even if someone has your device, they need your fingerprint or face to use the passkey.
Cross-Device Sync
Passkeys sync across your devices through your platform's secure credential system:
- Apple devices — sync via iCloud Keychain (same Apple ID)
- Google/Android devices — sync via Google Password Manager
- Windows devices — Windows Hello (may not sync across devices — register a separate passkey on each Windows machine)
Technical Standard
MAIA's passkey implementation uses WebAuthn/FIDO2 with ECDSA P-256. This is the same standard used by Google, Apple, Microsoft, and major banks.