When a user registers a passkey on a website, the authenticator generates a passkey and an identifier (credential ID). When the website wants to authenticate a user, it provides the identifier to the browser, which in turn provides it to the authenticator, which decrypts it and uses the passkey. Passkeys can serve as the first authentication factor, a second authentication factor, or even multiple authentication factors.