Passkeys are the most important thing happening in information security right now because they are the only principled solution to the overwhelming effectiveness of phishing attacks. Just like memory safety is the only principled solution to memory corruption attacks.

Interoperable, well‑specified passkey records that the application can handle as opaque strings, like password hashes, can be a middle‑ground abstraction layer. The proposal borrows the syntax of PHC strings and reuses the authenticator data encoding from Web Authn. A record looks likeుగ$webauthn$v=1$transports=hybrid+internal$<base64 authenticator data> and is stored as a single string in the database.

A potential crypto/passkey stateless Go package API is drafted on top of these records. It handles registration and login flows by passing JSON values to the browser’s credential APIs and caching challenges, while the application only tracks which opaque records belong to each user.

Duplicate Credential IDs are not a concern in this model because the login flow uses the user ID to look up passkey records; a shared Credential ID across accounts behaves like a shared password and does not introduce a new attack vector.