Skip to content
Bastyx
Early Access
Passwordless authentication Planned

Passwordless, from laptop login to production.

Most passwordless projects stop at the browser. Bastyx is designed to carry the same phishing-resistant identity to workstation login, SSH and internal apps, using passkeys, security keys and the biometric sensors your team already has.

Join Early Access
Concept render of a compact USB-C security key with a fingerprint sensor

Concept hardware. Standard FIDO2 keys work without it.

How it works

What “passwordless” should mean

Replacing a password with a one-time code sent by text isn’t passwordless in any meaningful sense: there’s still a secret a person can be tricked into typing. Real passwordless authentication uses public-key cryptography through the FIDO2 standards.

  1. At registration, the person’s authenticator creates a key pair. Only the public key is shared.
  2. At sign-in, the service sends a random challenge.
  3. The person confirms locally, with a touch, a PIN or a fingerprint matched on the device.
  4. The authenticator signs the challenge, bound to the service’s domain, and the service verifies it.

Nothing secret crosses the network or sits in a database, and a signature for the real domain can’t be produced on a phishing site.

Methods compared

Passkeys, security keys and biometrics

They’re complementary, not competing. Most teams use device passkeys day to day and hardware keys for sensitive access.

  • Phishing-resistant

    Synced passkey
    Yes
    Device-bound passkey
    Yes
    Security key
    Yes

  • Private key can’t be copied

    Synced passkey
    Synced by platform
    Device-bound passkey
    Yes
    Security key
    Yes

  • Survives losing a device

    Synced passkey
    Yes
    Device-bound passkey
    No
    Security key
    No

  • Extra hardware

    Synced passkey
    No
    Device-bound passkey
    No
    Security key
    Yes, per person

  • Biometric option

    Synced passkey
    Device sensor
    Device-bound passkey
    Device sensor
    Security key
    On some models

  • Best for

    Synced passkey
    Everyday app sign-in
    Device-bound passkey
    Managed laptops
    Security key
    Admins and production
Where it applies

One identity across every surface

  • Windows workstation login

    Sign in to Windows with a passkey, security key or fingerprint instead of a password.

    Planned

  • Linux workstation login

    Passwordless desktop login and sudo, backed by the same identity.

    Planned

  • SSH and servers

    Short-lived, identity-bound access with a security-key touch.

    Planned

  • Internal applications

    Single sign-on to the tools your team runs, with step-up where it matters.

    Planned

  • macOS login

    Being evaluated with early-access teams.

    Exploring
Biometrics and privacy

Biometrics stay on the device

With FIDO2, a fingerprint or face is matched by the authenticator itself. The service only receives a signature showing that verification happened. Bastyx is designed never to receive or store biometric data, and biometrics are always one option among several, never a requirement.

FAQ

Passwordless questions

What’s the difference between a passkey and a security key?

Both are FIDO2 credentials. A passkey usually lives on a phone or laptop and may sync between a person’s devices through their platform account. A security key is a separate piece of hardware whose credentials stay on that key. Security keys give the strongest guarantee that a credential can’t be copied; synced passkeys are easier to recover.

Are passkeys really phishing-resistant?

Yes. A FIDO2 credential is bound to the domain it was registered for, and the browser or operating system enforces that. A look-alike domain can’t request a signature for the real one, so there’s nothing for a person to be tricked into handing over.

What if someone loses their only authenticator?

That’s why every person should register at least two. The planned recovery flow in Bastyx requires admin approval and a second registered authenticator, so recovery can’t become the weak point.

Do we need special hardware?

No. Most modern laptops and phones can hold passkeys, and Bastyx is designed to work with standard FIDO2 security keys. Hardware keys are recommended for administrators and production access.

Bring every login, key and server under one control layer.

Bastyx is onboarding technical teams of 20–500 people for early access. Tell us what you’re securing.

Join Early AccessBook a Demo