---
title: "Use Passkeys Wherever You Sign in to Uber"
description: "Uber rolled out passkey authentication across mobile apps and websites, allowing users to sign in without passwords. Passkeys use a device-generated public-private key pair: the server stores the public key, while the device’s password manager protects the private key and requires biometric, PIN, or pattern authorization. Registration sends creation options and a challenge to the authenticator, which returns an attestation for server validation; sign-in similarly returns a signed assertion that the server verifies with the stored public key. This design keeps private keys and user authorization data on the authenticator, improving resistance to phishing, credential stuffing, brute force, and replay attacks. Uber reported low initial adoption and noted inconsistent browser and device support, user education needs, and technical complexity; it plans to use adoption data and post-authentication prompts to improve onboarding."
---

# Use Passkeys Wherever You Sign in to Uber

[Uber](https://yomu.fyi/company/uber) · May 26, 2026

**Type:** Explainer

## Summary

Uber rolled out passkey authentication across mobile apps and websites, allowing users to sign in without passwords. Passkeys use a device-generated public-private key pair: the server stores the public key, while the device’s password manager protects the private key and requires biometric, PIN, or pattern authorization. Registration sends creation options and a challenge to the authenticator, which returns an attestation for server validation; sign-in similarly returns a signed assertion that the server verifies with the stored public key. This design keeps private keys and user authorization data on the authenticator, improving resistance to phishing, credential stuffing, brute force, and replay attacks. Uber reported low initial adoption and noted inconsistent browser and device support, user education needs, and technical complexity; it plans to use adoption data and post-authentication prompts to improve onboarding.

## Context

Uber introduced passkey support during Cybersecurity Awareness Month as part of its effort to provide passwordless authentication across mobile and desktop experiences. The initial rollout revealed low adoption and differences in passkey support across browsers and operating systems.

## Approach / What changed

The implementation follows WebAuthn. During registration, the client requests credential-creation options and a unique challenge, the authenticator generates and stores a private key, and Uber stores the returned public key after validating the attestation. During authentication, the authenticator signs a server-provided challenge, and the server verifies that assertion with the account’s stored public key. Users can manage passkeys in Uber account settings, while fallback authentication remains available.

## Takeaways

- Passkeys keep the private key on the user’s authenticator and store only the public key on Uber’s server, so compromising the server does not reveal the private key.
- WebAuthn challenges help prevent replay attacks, while application-bound passkeys reduce phishing risk by limiting where a device can use them.
- Deleting a passkey from Uber removes only the server-side public key; the corresponding private key must also be removed from the device’s password manager, although it is unusable without both keys.

## FAQ

### Can a passkey created on one device be used on another device?

Yes. WebAuthn is standardized across platforms, enabling cross-device authentication; for example, a passkey created on Android can authenticate a user on a Windows desktop.

### What happens if the public key stored by Uber is compromised?

The passkey itself is not compromised because the private key remains on the authenticator. Authenticators also do not share private keys or user authorization data with the relying party.

### What are the main adoption challenges for passkeys at Uber?

Browser and operating-system support varies, creating technical edge cases and inconsistent device capabilities. Uber also identified a user knowledge gap and low initial adoption, and plans to improve onboarding with experiments and adoption data.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Passkeys](https://yomu.fyi/topic/passkeys), [Security](https://yomu.fyi/topic/security), [WebAuthn](https://yomu.fyi/topic/webauthn)

- Source: [Uber](https://www.uber.com/us/en/blog/use-passkeys-wherever-you-sign-in-to-uber)
- Source URL: https://www.uber.com/us/en/blog/use-passkeys-wherever-you-sign-in-to-uber
- Ingested by Yomu: 2026-09-14T00:02:05.722Z

[Read original post](https://www.uber.com/us/en/blog/use-passkeys-wherever-you-sign-in-to-uber)