A credential provider is the device feature or service that stores, manages, and presents login credentials such as passwords, passkeys, or recovery keys. Instead of making the user type a secret into every app or website, it can unlock and release the right credential after local approval, such as a fingerprint, Face ID, or device PIN. With passkeys, the private key often remains on the device or in a synced credential provider, while the app only receives a cryptographic proof of identity.
This matters because credential providers change how attackers try to steal access. A fake login page cannot simply capture a passkey the way it can capture a password, but the provider becomes part of the trust chain. If the device is compromised, the account recovery path is weak, or credential sync is abused, attackers may still gain access. Defenders rely on strong device security, phishing-resistant authentication, and careful recovery controls to keep the provider from becoming a single point of failure.