Passwords have been problematic for years. Users struggle to remember long, secure passwords, often resorting to risky practices like using weak passwords or reusing the same one across multiple sites. On top of that, data leaks are a constant concern.
Passkeys are the modern solution. They let you sign in using biometrics or a device PIN (which many experts recommend avoiding due to security concerns) instead of typing a password. Leading technology companies, such as Apple and Microsoft, already support passkeys across most devices.
The problem with passkeys, especially in Web3, is that they introduce another Web2 step: a centralized intermediary between the user and access to the site. What if accessing websites in Web2 and Web3 was integrated into a Web3 wallet with a user-friendly UX?
Now, thanks to Liquid Auth, passkeys are part of the Algorand ecosystem, removing the security risk and centralized nature of traditional passkeys. You can use your Pera Wallet to log in securely to supported websites, both Web3 and traditional Web2, without ever sharing a password.
Why decentralized passkeys matter
With Liquid Auth and Pera, your passkeys are decentralized. They are stored securely in your wallet, not in the cloud or a company’s server. This means:
- You do not have to depend on centralized third-party companies.
- You stay in control of your data and identity.
- You are protected from phishing and password leaks.
How it works
Liquid Auth uses a FIDO2-compliant protocol to connect your wallet directly to the site you are logging into, using an encrypted peer-to-peer channel. There are two steps: creation of the passkey and use of the passkey for authentication.
Here is what happens behind the scenes:
- The website asks for authentication.
- Pera Wallet uses the passkey that stays safely stored inside your wallet.
- You confirm the login using biometrics or your device PIN.
- The website verifies your wallet’s cryptographic signature and grants access.
There is no exchange of passwords, no authentication credentials stored on a company server. Your credentials never leave your device.
Your Pera Wallet acts as your personal passkey manager, giving you complete control over your credentials.
What you need
Before you start, make sure you have:
- iPhone iOS version 17 or later, or Android version 14 or later.
- The latest version of Pera Wallet (iOS or Android).
- An Algorand account set up in your Pera wallet. Please note that it must be a standard 24-word account (legacy accounts, i.e., 25 words, and Ledger accounts are not supported).
- Access to a browser that supports passkeys, such as Chrome, Safari, or Edge.
How to try it
You can test passkey login on any supported site, including:
- webauthn.io ⇒ ideal for tests
- GitHub
- Amazon
- X
- Gmail
Step-by-step guide to add a new passkey:
1 Enable Pera on your device.
2 Visit the website of your choice. In our example, we will use x.com.
3 Go to security => Passkeys.
4 Create a new passkey.
5 Sign in with Pera.
6 You are done!
Test your new passkey
1 Sign in by adding your username.
2 When requested, select Pera Algo Wallet.
3 Use biometrics to validate the operation.
4 You are now logged in, securely and instantly.
Important to know
Passkeys are stored locally on your device and aren't automatically shared across the same wallet on different devices.
If you move your wallet to another device, your passkeys won’t be transferred with it.
This means that, for now, if you ever transfer the wallet to another device, you must re-create your passkeys, as they won’t be transferred to the new one.
What’s next
More integrations are coming soon as Liquid Auth expands across the Algorand ecosystem and beyond.
Start using passkeys today and experience effortless, secure login. It is the simplest, safest way to sign in online, and it works across both Web2 and Web3 platforms.
Learn more at https://LiquidAuth.com/
FAQs
What is Liquid Auth?
Liquid Auth is Algorand's open, passwordless authentication protocol built to enable secure, decentralized Web3 login. It leverages the FIDO2 and WebAuthn standards to bring the passkey revolution to Web3.
How does Liquid Auth relate to passkeys?
Liquid Auth is the framework that integrates passkeys into the Algorand ecosystem. It uses a FIDO2-compliant protocol to connect your wallet directly to a site you are logging into, using an encrypted peer-to-peer channel. This makes your passkeys decentralized and stored securely in your wallet, not in a company's database.
What do I need to start using Liquid Auth with Pera Wallet?
To get started, you need:
- The latest version of Pera Wallet (iOS or Android).
- An Algorand account set up in your wallet that must be a standard 24-word account (not a legacy or Ledger account).
- Access to a browser that supports passkeys, such as Chrome, Safari or Edge.
Can I use Liquid Auth to sign in to traditional Web2 websites?
Yes. Liquid Auth works with Web3 applications and traditional Web2 platforms. The first implementation with Pera Wallet allows users to authenticate on sites like GitHub or Amazon using their Algorand account. Other supported sites include X and Gmail.
What are the main benefits of using Liquid Auth?
The main benefits include:
- Passwordless login and decentralized authentication
- A secure, self-owned identity for both Web2 and Web3
- Phishing resistance and protection from password leaks
- True peer-to-peer connections that don't rely on relay servers
- Keys remain in your wallet (user-sovereign)
Are my passkeys automatically transferred if I move my Pera Wallet to a new device?
No, passkeys are stored locally on your device and are not automatically shared across different versions of the wallet on different devices. If you transfer your wallet to a new device, you must re-create your passkeys.
Is Liquid Auth only for the Algorand blockchain?
Algorand developed Liquid Auth, but it is chain-agnostic and can be adopted by any blockchain ecosystem. Furthermore, it is open source and free for developers to integrate.
Where can I get more information about Liquid Auth?
Check out the Liquid Auth website for information, demos and documentation.
Disclaimer: The content provided in this blog is for informational purposes only. The information is provided by the Algorand Foundation and while we strive to keep the information up-to-date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the blog or the information, products, services, or related graphics contained in the blog for any purpose.
The content of this blog is not intended to be financial advice. You should not take any action before conducting your own research or consulting with a qualified professional. Any reliance you place on such information is therefore strictly at your own risk.
In no event will Algorand Foundation be liable for any loss or damage including without limitation, indirect, or consequential loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in connection with, the use of this blog.
Through this blog, you may be able to link to other websites which are not under the control of the Algorand Foundation. We have no control over the nature, content, and availability of those sites. The inclusion of any links does not imply a recommendation nor endorse the views expressed therein.