Back to feed
Dev.to
Dev.to
7/16/2026
The original title is "Beyond login: encrypting data with passkeys and WebAuthn PRF"

The original title is "Beyond login: encrypting data with passkeys and WebAuthn PRF"

Original: Beyond login: encrypting data with passkeys and WebAuthn PRF

Short summary

An architecture writeup for pknotes, an end-to-end encrypted notes app using the WebAuthn PRF extension to derive encryption keys from passkey login ceremonies. The server never sees key material — PRF output stays client-side and derives a key-encryption key wrapping a random master key. The design supports multi-device sync, paper-based recovery codes, and proper revocation through key rotation.

  • •WebAuthn PRF extension provides deterministic 32-byte output during passkey login — usable as an encryption key
  • •Architecture uses HKDF-derived KEK wrapping a random master key, enabling multi-device sync without re-encryption
  • •Includes AAD for ciphertext integrity, single-use recovery codes, and true revocation via key rotation

Generated with AI, which can make mistakes.

Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

Passkeys Are Easy to Demo and Hard to Ship. Here's the Part the Tutorials Skip
Dev.to
The original title is "How Zero-Knowledge Encryption Actually Works (with the Web Crypto API)"
Dev.to
The original title is "Passkeys for SMBs: Going Passwordless in 2026 (A Developer's Guide)"
Dev.to
How I built an end-to-end encrypted pastebin (and why the server can’t read your text)
Dev.to