A device unlock factor is a local check, such as a fingerprint, Face ID, or device PIN, that approves use of a passkey stored on a phone, laptop, or security key. It is not the passkey itself and it is not shared with the website. Instead, it unlocks the device so the cryptographic login can complete. The service receives proof from the passkey, while the biometric or PIN stays on the user’s device.
This matters because passkeys reduce phishing by removing reusable passwords, but the protection depends on the device being trustworthy. If an attacker steals an unlocked device, tricks a user into approving access, or abuses weak local PIN policies, they may be able to use the passkey. Defenders therefore care about device security, strong screen locks, secure enrollment, and safe recovery flows. In real attacks, criminals often shift from password phishing to stealing devices, bypassing local checks, or targeting fallback sign-in paths.