What Is a Passkey QR Code and How Cross-Device Login Works

A passkey QR code is a dynamic, on-screen barcode generated during cross-device authentication that allows you to sign in on a computer or secondary screen using a passkey stored on your mobile phone. Scanning this code establishes a secure local channel, verified through Bluetooth proximity, letting your phone sign a cryptographic challenge so you can log in without typing a password.

What Is a Passkey QR Code and Why Does It Appear?

Passkeys replace passwords by using public-key cryptography. Instead of sending a shared secret across the internet, your device creates an asymmetric key pair: a private key that stays locked on your local hardware and a public key registered with the online service. When you sign in, the service issues a cryptographic challenge. Your device unlocks its stored private key using a local screen lock—such as a fingerprint, face scan, or device PIN—and digitally signs the challenge. The service then verifies this signature against your registered public key.

Operating systems and password managers sync passkeys within their native environments. For example, passkeys created within one platform’s cloud keychain automatically populate across devices registered to that same ecosystem. However, passkeys do not automatically sync across competing platforms, different operating systems, or standalone browsers on unlinked machines.

When you attempt to sign in to an account on a desktop browser that does not have your passkey stored locally or synced to its keychain, the website offers cross-device authentication. The desktop displays a temporary QR code. This passkey QR code acts as a bridge: it passes connection data to your smartphone, initiating a direct verification handshake between the two devices.

How the QR Code and Bluetooth Proximity Handshake Operate

The passkey QR code does not store your private key or send your biometric data across the screen. Biometric factors—like fingerprints or facial scans—remain strictly on your local hardware and are never transmitted to the website or the remote computer. Instead, the QR code facilitates a short-range, multi-step handshake:

1. Session Initialization: The desktop browser asks the authentication server for a login challenge and renders a unique passkey QR code containing session connection parameters.
2. Code Scan: You open your phone camera or built-in scanner and scan the displayed QR code. This tells your phone which site and session are requesting access.
3. Proximity Check via Bluetooth: Both devices use Bluetooth to confirm they are physically near each other. This proximity verification prevents remote attackers from tricking you into scanning a code from afar to hijack your session.
4. Local Biometric Verification: Your phone prompts you to confirm your identity using your standard screen lock: a face scan, fingerprint, or unlock PIN.
5. Cryptographic Signature: After you unlock the device, the phone uses the stored private key to sign the challenge from the website.
6. Token Transfer: The signed response transfers back to the browser on the computer, satisfying the login request and granting access.

When examining the hardware authenticity of authenticators used during these WebAuthn exchanges, administrators and developers can identify the authenticator model using our WebAuthn AAGUID Lookup to inspect the Authenticator Attestation GUID.

Step-by-Step Worked Example: Signing In on an External Desktop

To see this process in practice, consider a scenario where you are using a workstation at an office library to access an account, while your primary passkey resides on your personal smartphone.

System Parameters and Requirements

• Workstation Desktop: Running Windows 10 (ChromeOS 109+, macOS Ventura, or Windows 10+ supported) with Chrome version 120 (Chrome 109+, Safari 16+, Edge 109+, or Firefox 122+ supported).
• Mobile Device: Running iOS 17 (iOS 16+ or Android 9+ supported) with screen lock configured and Bluetooth enabled.
• Account Configuration: Multi-factor authentication already enabled; passkey created previously on the smartphone.

+--------------------------------------------------------------------------+
| WORKED CROSS-DEVICE AUTHENTICATION FLOW |
+--------------------------------------------------------------------------+
| Step 1: Workstation Browser |
| - User navigates to account sign-in page. |
| - User selects "Use a passkey" -> "Use a phone or tablet". |
| - Browser generates and displays ephemeral QR code on monitor. |
| |
| Step 2: Proximity Check |
| - User turns on Bluetooth on both the workstation and mobile device. |
| - Proximity validation: Confirms phone is physically within range. |
| |
| Step 3: Mobile Capture & Verification |
| - User scans the monitor's QR code using the smartphone camera. |
| - Phone displays prompt: "Sign in to example.com?" |
| - Phone requests biometric confirmation. |
| - User scans fingerprint / face unlock. |
| |
| Step 4: Cryptographic Completion |
| - Private key inside phone signs server challenge. |
| - One-time signature passes over local link to workstation browser. |
| - Desktop signs in successfully; 2-Step Verification bypassed. |
+--------------------------------------------------------------------------+

Because the passkey serves as proof of device possession and user verification, it bypasses the second authentication step in accounts with standard 2-Step Verification or Advanced Protection programs.

The Downsides, Limitations, and Mistakes Users Encounter

While passkey QR codes solve cross-platform access, they introduce operational constraints and trade-offs compared to legacy credentials:

• Cross-Ecosystem Friction: Passkeys sync effortlessly within a single ecosystem (such as between two devices sharing the same cloud account), but crossing boundaries (e.g., from an Android phone to a Mac running Safari, or an iPhone to a Windows PC) forces you to scan a QR code every time unless you register a standalone passkey on both machines.
• Physical Proximity Dependency: The authentication requires Bluetooth enabled on both devices. If Bluetooth is turned off, disabled by corporate policy, or malfunctioning, the proximity check fails, and the cross-device login cannot complete.
• Shared Device Risks: If you create a passkey directly on a shared or public computer rather than using the temporary cross-device QR code flow, anyone who can unlock that shared computer can gain access to your account.
• Account Recovery Delays: When adding a newly created passkey to certain accounts, security policies may impose a waiting period of up to 7 days before that passkey becomes available for sign-in, preventing immediate backup usage.
• Organizational Restrictions: Accounts managed through school or employer Workspace environments may restrict password-less sign-ins, requiring administrative approval on policy pages before passkeys can be used alone.
• Trying to Scan on the Same Screen: A frequent user error is attempting to scan a passkey QR code using the exact same device that displays it. The QR code mechanism exists strictly for cross-device authentication; it cannot be scanned by the single device trying to sign in.