What is a passkey?
A passkey replaces a password with a public and private key pair. The private key never leaves your device and is unlocked by your fingerprint, face, or device PIN; the site only ever stores the public key. Because nothing secret is transmitted, passkeys cannot be phished, reused, or stolen in a database breach.
- Topic
- Authentication
- Also called
- FIDO2 credential, WebAuthn credential
- Reading time
- 1 min
- Reviewed
On this page
How signing in works
The site sends a random challenge. Your device signs it with the private key after you authenticate locally, and returns the signature. The site verifies it against the stored public key. No shared secret ever crosses the network, which removes the entire class of attacks based on capturing one.
Where passkeys fall short today
Coverage is incomplete. Many sites still require a password as a fallback, and that fallback remains the weakest link. Syncing across ecosystems is improving but can still be awkward, and recovery generally routes through your platform account, which becomes a new point of concentration.
What people often get wrong
"Passkeys mean I no longer need a password manager."
Eventually, perhaps. Today almost every site that offers passkeys keeps password login enabled as a fallback, so the password still has to be strong and unique.
Sources
These primary references support the terminology and current security guidance used in this definition.
