Why the Future of Online Exams Belongs to Passkeys (FIDO2)

Quick Answer: Passwords and SMS OTPs are the easiest part of an online exam to cheat. A student forwards a code to a proxy test-taker in seconds. FIDO2 passkeys replace shared secrets with device-bound cryptographic keys unlocked by the student's own biometric — a credential that physically cannot be forwarded, sold, or phished. The authentication problem in online exams is solved. Most institutions just haven't implemented the solution yet.

The moments leading up to a high-stakes online exam are universally fraught. Students sit in front of their screens, adrenaline surging, mentally running through formulas, case laws, or historical dates.

Then the exam gate opens — and friction hits:

• A forgotten password triggers a panicked, multi-step reset
• A delayed SMS OTP ticks away precious test time
• Opening an authenticator app forces the student to look away from their screen — inadvertently triggering a proctoring flag for suspicious behaviour

For universities and certification bodies, the administrative stakes are equally high. Shared credentials and forwarded OTPs fuel a lucrative black market for proxy test-takers. The authentication method is often the weakest link in an otherwise rigorous exam setup.

Online assessment needs an authentication architecture that eliminates student anxiety while locking down institutional integrity. FIDO2 passkeys and hardware-backed biometric logins deliver exactly that.

The Core Conflict: Speed vs. Security

In conventional identity systems, security and friction move together. More security has historically meant more steps — more failure points on exam day.

FIDO2 passkeys are the first authentication method that resolves the speed-security conflict entirely. Authentication is faster than typing a password — and significantly harder to spoof than any shared secret.

What Is FIDO2 and How Does It Work in an Exam Context?

FIDO2 is the technical standard behind passkeys — developed by the FIDO Alliance and backed by Apple, Google, Microsoft, and all major browser vendors. It replaces passwords with asymmetric public-key cryptography tied to the student's physical device.

Here is the exam-day flow in three steps:

Step 1 — Usernameless autofill When the student opens the testing portal, the browser recognises the site and surfaces an autofill prompt for their passkey. No institutional email string. No password field.

Step 2 — Single-gesture biometric handshake The platform prompts the student for one gesture: Touch ID, Face ID, Windows Hello, or a hardware security key. The entire process takes under 3 seconds.

Step 3 — Cryptographic verification The student's biometric never leaves their device. The local biometric match unlocks a hardware-bound private key inside the device's secure enclave (TPM or Secure Element), which signs a cryptographic challenge issued by the exam server. The exam portal verifies the signature against the registered public key and grants entry — instantly.

No shared secret is ever transmitted. No password is ever stored on a server. Nothing can be intercepted in transit because nothing secret travels over the network.

Why This Matters More for Exams Than Any Other Authentication Context

Most applications use authentication to protect accounts. Exams use authentication to prove identity — that the person taking the exam is the person enrolled in the course.

This distinction is critical. A password proves you know a secret. A FIDO2 passkey proves you are physically present with a specific device that has been biometrically registered to a specific person.

A proxy test-taker cannot use a passkey because:

• The passkey is bound to the original student's device
• The device unlock requires the original student's biometric (face or fingerprint)
• The credential cannot be exported, copied, or shared — it exists only in the secure enclave

Even if a student handed their laptop to a proxy, the proxy cannot unlock the passkey without the student's face or fingerprint. This is categorically different from forwarding an SMS OTP or sharing a password.

The Privacy Argument: Biometric Data Should Stay on the Device

This is where the implementation matters enormously — and where most proctoring tools get it wrong.

Several major proctoring platforms, including Honorlock and Mercer | Mettl, collect photo IDs and process face biometrics centrally on their own cloud servers. This means a student's biometric data travels over a network, is stored on a vendor's infrastructure, and is subject to that vendor's data retention and security policies.

This creates real institutional risk:

• GDPR obligations for European students
• PDPA obligations for students in India and Southeast Asia
• Student privacy governance concerns at institutions with active data sovereignty policies
• The downstream liability if that vendor's server is breached

MonitorExam's implementation of FIDO2 is fundamentally different. The student verifies identity using their own device's built-in facial recognition or fingerprint sensor. The biometric data never leaves the student's device. What travels to MonitorExam's server is a cryptographic signature — mathematically verifiable, but useless to anyone who intercepts it.

This is not a marketing distinction. It is an architectural one with direct compliance implications.

FIDO2 Passkeys + Camera-Optional Proctoring: The Combination That Changes Equity

Here is an angle that never gets discussed in the passkeys conversation: decentralised biometric verification removes the need for a mandatory webcam in the proctoring layer.

Most proctoring tools require a webcam for identity verification — a photo or video of the student's face matched against an ID. This creates an equity problem. Students without webcams, students on shared devices, students in low-bandwidth environments — they're all excluded from camera-mandatory proctoring.

MonitorExam's FIDO2 integration handles identity verification at the device level before the exam begins. By the time the exam starts, the system already knows — cryptographically — that the registered student is present. The proctoring layer doesn't need to duplicate this with a webcam check.

This is what makes camera-optional proctoring genuinely secure rather than just a convenience compromise. Identity is verified by FIDO2. Behaviour during the exam is monitored by the proctoring level you set. The two functions are separated cleanly.

A student in rural India on a 4G smartphone can sit a fully identity-verified, CredScore-reported exam at Level 3 — browser lockdown, tab tracking, copy-paste detection — with no webcam required, because FIDO2 already confirmed who they are.

The Institutional Payoff: Three Problems Eliminated at Once

1. The proxy test-taker market

The global market for hired exam proxies is estimated in the hundreds of millions of dollars annually. It exists because passwords and OTPs are transferable. FIDO2 passkeys are not. A credential that cannot be forwarded eliminates the mechanism the proxy market depends on.

2. Exam-day lockouts

Password resets and failed OTP deliveries are among the most common exam-day support escalations for any institution running online assessments at scale. FIDO2 passkeys have no password to forget and no OTP to delay. The lockout category effectively disappears.

3. False proctoring flags from authentication friction

Students using authenticator apps during the exam look away from the screen — triggering motion flags. Students typing passwords under time pressure exhibit stress behaviours the AI reads as suspicious. FIDO2 authentication is complete before the exam begins — the proctoring session starts with a student who is already verified, calm, and looking at their screen.

How MonitorExam Implements FIDO2

MonitorExam builds FIDO2 passkey authentication into the exam onboarding flow directly. The student registers their passkey once — linked to their device's biometric — and uses it for all subsequent exams on the platform.

During the exam, the FIDO2 verification feeds into MonitorExam's CredScore integrity report — a 7-dimension analysis that includes biometric verification as one of its scored dimensions alongside tab switching, copy-paste activity, screen behaviour, webcam activity (where enabled), and time patterns.

The combination — FIDO2 identity verification + configurable proctoring levels + CredScore reporting — means institutions get a complete integrity picture without centrally storing a single biometric.

For institutions evaluating this against Honorlock or Mettl, the architectural difference is direct: those platforms centralise biometric data on vendor servers. MonitorExam's FIDO2 keeps it on the student's device. The exam record is equally complete. The privacy exposure is categorically lower.

Moving Toward a Passwordless Testing Environment

Transitioning to FIDO2 passkeys does not require re-architecting your entire testing stack.

If you use a centralised identity provider: Microsoft Entra ID, Okta, and Ping Identity all support passkey enforcement via Conditional Access Policies. You can require passkey credentials specifically for your exam portal application without changing anything else.

If you use an LMS: Canvas, Moodle, and Blackboard can leverage native browser credential APIs for zero-hop logins directly from the LMS interface.

If you use MonitorExam: FIDO2 is built into the platform. No additional integration required. Students register once, authenticate in under 3 seconds for every subsequent exam.

The transition timeline for most institutions is weeks, not quarters. The operational payoff — eliminated lockouts, eliminated proxy vulnerability, eliminated false flags from authentication friction — is immediate.

Related Reading

• Honorlock vs MonitorExam — Why Browser Lock-In Is the Wrong Tradeoff
• Proctorio vs MonitorExam — Is Proctorio Free? Full 2026 Comparison
• In-Exam Live Chat: Why Real-Time Intervention Changes Online Proctoring

Frequently Asked Questions

What is FIDO2 in online exams? FIDO2 is a cryptographic authentication standard that replaces passwords with device-bound passkeys unlocked by the student's own biometric (face ID or fingerprint). In online exams, FIDO2 verifies that the registered student is physically present with their registered device — without transmitting any biometric data to an external server.

Are passkeys safe for online exams? Passkeys are significantly harder to spoof than passwords or SMS OTPs. A FIDO2 passkey is bound to a specific device and requires a biometric match on that device to unlock — it cannot be forwarded, sold, or phished. For online exam identity verification, they represent the most secure widely-available authentication method.

Can a passkey be shared or forwarded? No. Unlike a password or OTP, a FIDO2 passkey exists only in the secure enclave of the registered device. It cannot be exported, copied, emailed, or sent to another person. A proxy test-taker cannot use a passkey without the original student's device and biometric.

Does MonitorExam store student biometric data? No. MonitorExam uses FIDO2 passkey authentication. The student's biometric (face or fingerprint) is processed locally on their device by the device's own secure enclave. Only a cryptographic signature is sent to MonitorExam's server — the biometric data itself never leaves the student's device.

What is the difference between FIDO2 and a regular password + OTP for exams? A password can be shared. An OTP can be forwarded. Both are "shared secrets" — once the student has them, they can pass them to someone else. A FIDO2 passkey is a "hardware-bound credential" — it only works on the specific device it was registered to, unlocked by the specific biometric it was registered with. There is no shared secret to share.

Does FIDO2 work on mobile phones? Yes. FIDO2 is supported natively on iOS (Face ID / Touch ID) and Android (fingerprint / face unlock) through the WebAuthn browser API. Students can authenticate with a passkey from any modern smartphone.

Can FIDO2 replace webcam identity verification? In MonitorExam's implementation, FIDO2 handles identity verification at the device level before the exam begins. This allows camera-optional proctoring at lower exam levels — the proctoring layer monitors behaviour during the exam, while FIDO2 has already confirmed identity at the gate. This combination provides both verified identity and monitoring without mandatory webcam requirements.

Is FIDO2 compatible with Canvas, Moodle, or Blackboard? Yes. FIDO2/WebAuthn is supported by all major browsers and can be integrated with Canvas, Moodle, and Blackboard through native browser credential APIs or via centralised identity providers like Microsoft Entra ID or Okta.