Passkey: Definition & explanation

A passkey is built on the FIDO2/WebAuthn standard. During registration, the device generates a key pair: the private key stays securely stored on the smartphone or in a password manager, while the public key is sent to the service. At login, the server issues a cryptographic challenge that the device signs with the private key — only after unlocking via fingerprint, face recognition, or PIN. Since the private key never leaves the device, there's nothing to steal or guess, unlike traditional passwords. Passkeys are often synced across devices via cloud services (e.g., iCloud Keychain or Google Password Manager), making them usable on multiple devices. Major platforms like Apple, Google, Microsoft, and increasingly banks and online shops already support passkeys as a login method. They're considered significantly more phishing-resistant since they only work with the actual domain and can't be entered on fake websites. Adoption typically happens gradually: users can set up passkeys alongside existing passwords and later switch entirely.