Yes. A site can let people sign in with passkeys without putting their email address in the WebAuthn user handle. Give each account a stable, opaque identifier instead. You will still need a server-side account record linking that identifier and each credential to the account, plus the credential’s public key to verify sign-ins. The authenticator keeps the private key; your site should not.
What “without storing emails” means for passkeys
A passkey uses a public/private key pair scoped to a relying party (RP), usually your site. The authenticator holds the private key and uses it to sign an authentication response. Your server stores the public key and uses it to verify that response. MDN’s Web Authentication API guide explains the browser flow and credential model.
As an Amazon Associate I earn from qualifying purchases.
You can keep email out of the authenticator-facing WebAuthn user handle by using a random, stable account ID for user.id. Keep that ID separate from any account details you do retain. The server still needs a way to associate the account ID and registered credential IDs with an account; omitting email from the handle does not remove that mapping or the need to store public keys.
Recommended Free Tools
The W3C WebAuthn Level 4 document dated September 15, 2026, is a Working Draft, not a final Recommendation. Its draft language says: “the Relying Party MUST NOT include personally identifying information, e.g., e-mail addresses or usernames, in the user handle.” See the WebAuthn Level 4 Working Draft.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The five server steps
1. Choose an opaque account ID and configure the relying party
Generate a non-identifying, stable ID for each account and use it as the WebAuthn user handle. It should not encode an email address or username. Maintain the account record separately, including a mapping from that ID to the account and its credentials.
Set the RP ID to the domain you intend the passkey to work for. It must align with the site origin used in the browser flow; changing the RP ID later can affect which credentials are usable.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Create registration options with a fresh challenge
When an authenticated or otherwise authorized user begins passkey registration, the server creates WebAuthn creation options, including the account’s opaque user ID and a new unpredictable challenge. Bind the challenge to that pending registration and session, then send the options to the browser. MDN describes a challenge as a random value specific to the request that an attacker should not be able to predict; its guidance says to invalidate a challenge after about 10 minutes. Treat that interval as guidance, not as a universal protocol limit. See MDN’s attestation and assertion guidance.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →3. Verify registration and store the public credential data
The browser calls WebAuthn create() and returns a credential response. Before accepting it, the server verifies that it matches the pending registration, including the expected challenge and relying-party context. On success, store the credential ID, public key, account mapping, and any authenticator metadata needed by your implementation. Do not store the passkey’s private key: it remains with the authenticator.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Issue a separate challenge for sign-in
Authentication is a new request, not a continuation of registration. Generate a fresh challenge, bind it to the sign-in attempt, and send authentication options to the browser.
Your credential flow determines how the user is identified:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Discoverable credentials: The authenticator can offer an account or credential choice without the site first asking for an email or username. This supports a usernameless entry point, but your server still needs to map the returned credential or user handle to an account.
- Non-discoverable credentials: The site identifies the user first, then supplies the credential IDs allowed for that account. If you do not collect email, you need another way to identify the account before this step.
MDN describes this discoverable versus non-discoverable distinction in its Web Authentication API guide.
5. Verify the assertion before creating a session
The browser returns an assertion signed using the authenticator’s private key. Verify it on the server before issuing a session. At minimum, the verifier needs to check the challenge against the pending sign-in, ensure it is valid and unused, validate the relying-party ID and origin, check the required user-presence and user-verification flags, and verify the signature using the public key stored for that credential. Then map the credential or user handle to the account and establish the session only after all checks pass.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Google’s passkey server guide covers registration and authentication verification. A server-side WebAuthn library can handle much of the protocol-specific option generation and verification; review its current API and defaults rather than treating a successful browser response as verified authentication.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Decisions to make before launch
- Account discovery: Decide whether sign-in starts with a discoverable credential picker or asks for another account identifier before offering credentials.
- User verification: Choose whether your policy requires an authenticator to verify the user, and enforce the corresponding verification result server-side.
- Recovery and re-binding: Decide how a person regains access if they lose access to their passkey or needs to register a replacement. The approach depends on your account model; passkeys do not define your site’s recovery policy.
- Platform support: Check the browsers, operating systems, and authenticators your users rely on. Availability and user experience vary and can change.
Do users need a hardware security key?
No. A FIDO2 security key, such as a YubiKey, is one possible authenticator, alongside built-in device authenticators and credential managers. Requiring a physical key would be a product choice, not a prerequisite for implementing passkey sign-in. See MDN’s Web Authentication API overview.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches
