Where Are Passkeys Stored on Android?

Where Are Passkeys Stored on Android?#

Passkeys on Android are primarily stored in the Google Password Manager, with the option to use third-party password managers like 1Password or Dashlane starting from Android 14. The private key associated with each passkey is securely stored in the device's Trusted Execution Environment (TEE), ensuring robust security and protection against unauthorized access.

Passkeys on Android are stored in Google Password Manager or third-party password managers.
The private key is always kept in the Trusted Execution Environment (TEE).
Android users automatically have a passkey that is created by default and cannot be deleted.

Detailed Overview of Passkey Storage on Android#

Android's approach to passkey storage has evolved over time, enhancing both security and user flexibility. Here's a breakdown of how passkeys are stored on Android devices:

Until Android 13: All passkeys were exclusively stored and synced within the Google Password Manager. This was the sole option available to users for managing their passkeys on Android devices.
Android 14 and Beyond: With the introduction of Android 14, users gained the ability to store passkeys not only in Google Password Manager but also in third-party password managers like 1Password and Dashlane. This development provides users with greater flexibility in managing their authentication credentials across different platforms and services.
Trusted Execution Environment (TEE): Regardless of where the passkey is stored (Google Password Manager or a third-party password manager), the private key of the passkey is always stored within the device's Trusted Execution Environment (TEE). The TEE is a secure area of the main processor in Android devices that ensures the confidentiality and integrity of keys. This makes it extremely difficult for malicious software to access or tamper with the private keys.
Default Passkey: Every Android user is automatically assigned at least one passkey that cannot be deleted. This default passkey is essential for the Android security framework, providing a secure baseline for user authentication.

Discuss passkeys news and questions in r/passkey.

Join Subreddit

Security Implications and Best Practices#

The storage of passkeys in a secure environment like the TEE ensures that even if the storage system (Google Password Manager or a third-party manager) is compromised, the private key remains protected.

By understanding where passkeys are stored and how they are protected, users can better appreciate the security features built into Android, providing peace of mind in their digital interactions.