# EIP-7951: Precompile for secp256r1 (Passkeys)

Source: https://www.eipsfordesigners.com/standards/EIP-7951
Agent brief: https://www.eipsfordesigners.com/standards/EIP-7951/agent.md
Machine-readable JSON: https://www.eipsfordesigners.com/api/standards/EIP-7951
Last reviewed: 2026-04-05
Last updated: 2026-04-05

| Field | Value |
| --- | --- |
| Status | Final |
| Chain | both |
| Category | Onboarding & Access |
| Journey stages | Authentication & Identity |
| Detailed guide | Yes |
| Official specification | https://eips.ethereum.org/EIPS/eip-7951 |
| Discussion search | https://ethereum-magicians.org/search?q=EIP-7951 |

## UX Impact

Users authenticate with passkeys (Face ID, Touch ID, Windows Hello, hardware security keys) instead of seed phrases — familiar biometric login for blockchain. Design implications: design passkey registration flows using device-native prompts, show biometric authentication UI for transaction signing, remove seed phrase backup requirements for passkey-only accounts, support multiple passkeys per account for device redundancy. Design decisions: decide whether passkeys supplement or replace traditional keys, design recovery flows when passkey device is lost, handle cross-device passkey sync (iCloud Keychain, Google Password Manager), consider showing security level differences between platform vs roaming authenticators. Final on Ethereum; Monad has native secp256r1 support — design passkey-first onboarding on both chains.

## Summary

EIP-7951 adds native support for passkeys (Face ID, Touch ID, Windows Hello) to sign blockchain transactions. Instead of managing seed phrases, users authenticate with their face or fingerprint. The browser's secure hardware generates and stores keys. This is the biggest onboarding unlock: anyone with a phone can use crypto like they use Apple Pay.

## For Designers

- You can design UI that delivers face ID or fingerprint.
- You can design UI that delivers "Sign up with Face ID", feels like any other app.
- You can design UI that delivers keys in Secure Enclave/TPM, never extracted.

## Applicability

### When to Use

- Your product addresses: seed phrases are terrible UX and security risk.
- Your product addresses: new users scared away by key management complexity.
- The flow should deliver: face ID or fingerprint, backed up to iCloud/Google automatically.
- Connect flows must list wallets with names, icons, and explicit user choice.

### When to Avoid

- Require secondary recovery (guardians, backup key).
- "Face ID", "Touch ID", "Fingerprint", "Passkey".
- Allow device passcode as fallback authentication.
- Wallet or chain support is fixed and users cannot choose providers.

## Problems It Solves

### Seed phrases are terrible UX and security risk

Impact: critical

Old way: Write down 12-24 words, store them safely, never lose them

New way: Face ID or fingerprint, backed up to iCloud/Google automatically

### New users scared away by key management complexity

Impact: critical

Old way: Explain private keys, wallets, security... users leave

New way: "Sign up with Face ID" — feels like any other app

### Mobile wallet apps have security vulnerabilities

Impact: high

Old way: Keys stored in app, potentially accessible to malware

New way: Keys in Secure Enclave/TPM, never extracted

### Hardware wallets expensive and clunky

Impact: high

Old way: Buy $100+ device, connect via USB, manage firmware

New way: Your phone IS the hardware wallet

### Account recovery requires seed phrase backup

Impact: high

Old way: Lose phrase = lose funds forever

New way: Device syncs passkey via cloud (iCloud Keychain, etc.)

## Anti-Patterns

### Only offering passkey with no fallback

Severity: critical

Lost all devices = lost wallet forever

Instead: Require secondary recovery (guardians, backup key)

### Calling it "secp256r1" or "WebAuthn" to users

Severity: high

Technical jargon that means nothing to users

Instead: "Face ID", "Touch ID", "Fingerprint", "Passkey"

### No biometric fallback (PIN/password)

Severity: high

Wet fingers, injuries, etc. can block biometric

Instead: Allow device passcode as fallback authentication

### Not explaining cloud sync clearly

Severity: medium

Users don't understand how recovery works

Instead: Show "Backed up to iCloud" or "Synced via Google"

### Hiding where passkey is stored

Severity: medium

Users worried about security can't evaluate it

Instead: Explain "Key stored in your device's secure chip"

### Requiring passkey for low-value actions

Severity: medium

Friction fatigue — users annoyed by constant prompts

Instead: Session keys for frequent/low-value, biometric for high-value

## UI Components

### BiometricPrompt

Native system prompt for Face ID/Touch ID/Windows Hello
States: idle, prompting, success, failed, unavailable
Props: reason, fallbackTitle, onSuccess, onFail

### PasskeyCreator

Creates new passkey and associates with smart wallet
States: ready, creating, syncing, complete, error
Props: accountAddress, rpId, userName

### DeviceSyncIndicator

Shows which devices have access to passkey
States: syncing, synced, offline
Props: devices[], lastSync

### PasskeyAuthButton

Initiates passkey authentication flow
States: idle, waiting, authenticated, error
Props: onAuth, fallbackOptions

### RecoveryMethodManager

Configure and view recovery options
States: no-backup, partial, fully-configured
Props: methods[], onAddMethod, onRemoveMethod

## On Monad

### Native Support

Ethereum: Requires ERC-4337 + custom verifier contract

Monad: EIP-7951 precompile makes verification 100x cheaper

Design implication: Passkey wallets more economically viable on Monad

### Transaction Confirmation

Ethereum: Sign → wait 12+ seconds → confirmed

Monad: Sign → instant confirmation (sub-second)

Design implication: Biometric + instant feedback feels native

### Gas for Verification

Ethereum: ~250k gas for secp256r1 verification

Monad: ~3k gas with precompile

Design implication: Can use passkeys for every transaction economically

### Reserve Balance

Ethereum: N/A

Monad: Passkey wallets still need 10 MON reserve; delegated accounts cannot use emptying exception

Design implication: Show spendable vs total even for passkey accounts

## Key Takeaways

- Passkeys = Face ID/Touch ID for crypto
- Always require backup recovery method
- Use human terms: "Face ID" not "secp256r1"
- Show cloud sync status clearly
- On Monad: 100x cheaper passkey verification via precompile

## UX Patterns

### Passkey Wallet Creation

One-tap wallet creation with biometric

User flow:

- User taps "Create Wallet"
- System shows Face ID prompt
- User authenticates with face/fingerprint
- Passkey created and synced
- Wallet ready to use

Mockup registry key: `concept/siwe-sign-in` (React UI on the live standard page).

### Transaction Signing with Biometric

Confirm transactions with face or touch

User flow:

- User initiates transaction
- App shows transaction details
- Biometric prompt appears
- User authenticates
- Transaction signed and broadcast

Mockup registry key: `concept/siwe-sign-in` (React UI on the live standard page).

### Multi-Device Passkey Sync

Access wallet from any device in your ecosystem

User flow:

- User opens app on new device
- Detects existing passkey via cloud
- Shows available devices
- User authenticates with biometric
- Wallet loaded instantly

Mockup registry key: `concept/siwe-sign-in` (React UI on the live standard page).

### Passkey + Guardian Recovery

Fallback when biometric device is lost

User flow:

- User views recovery settings
- Sees passkey as primary method
- Guardians as backup
- Can add additional methods
- All methods shown with status

Mockup registry key: `concept/siwe-sign-in` (React UI on the live standard page).

## Technical Notes

EIP-7951 adds a precompile at a designated address that performs secp256r1 (P-256) signature verification. This is the curve used by WebAuthn/passkeys. Without this precompile, verification costs ~250k gas via Solidity implementation. The precompile reduces this to ~3k gas. Passkeys are created via WebAuthn API, stored in device Secure Enclave, and synced via platform keychain (iCloud, Google Password Manager).