The problem passkeys try to solve
A password is a shared secret. You know it, and the website stores some record of it so it can check what you type. That arrangement has several weak points. People reuse passwords, pick guessable ones, and type them into fake pages that look real. Websites that store password records can be breached, which then exposes users who reused the same password elsewhere.
A passkey is a different kind of login. Instead of a secret you remember and type, it relies on a pair of cryptographic keys, and you prove who you are by unlocking your device. Passkeys are still new enough that support varies between sites and devices, so it helps to understand what they are and how they behave.
How public-key login works
The core idea is public-key cryptography. When you create a passkey for a website, your device generates two linked keys:
- a public key, which is sent to the website and stored with your account
- a private key, which stays on your device and is never sent anywhere
The two keys are mathematically related, but knowing the public key does not let anyone work out the private one. The public key can only check signatures made by the private key; it cannot create them.
When you later sign in, the sequence is roughly this:
- The website sends your device a one-time challenge, essentially a random piece of data.
- Your device asks you to confirm, usually with your fingerprint, face or device PIN.
- If you confirm, the device uses the private key to sign the challenge.
- The website checks the signature with the stored public key. If it matches, you are in.
Your fingerprint or face is used only to unlock the private key on your own device. The biometric data is not sent to the website, which is an important difference from how the idea is sometimes described.
Why this differs from a password
Several practical differences follow from the design.
Nothing secret is stored on the website. The site holds only a public key. If its database is leaked in a data breach, the stolen public keys cannot be used to log in as you.
There is nothing to guess or reuse. The private key is generated by your device and is not something a person chooses, so it is not a weak word or a recycled phrase. Each website gets its own separate key pair.
It resists phishing. A passkey is tied to the genuine website address it was created for. If you land on a lookalike page, your device will not offer the passkey for it, because the address does not match. This removes the situation where a person is tricked into typing a secret into a false page, which is the basis of many phishing scams.
It is quicker. There is no password to remember or type, and no code to copy from a text message.
Where the private key lives
Passkeys have to be stored somewhere, and the choices affect convenience and risk.
- Device-bound. A key stays on one device, such as a phone or a hardware security key. This limits exposure, but losing the device means losing that passkey.
- Synced. Many platforms can copy passkeys between your devices through an encrypted cloud account, so a new phone can receive them. This is convenient, but it means the security of that account matters a great deal.
- Held in a credentials app. Some dedicated password tools can store and sync passkeys across different brands of device.
Which options are available depends on your phone, computer, browser and the services you use, and the details change as the technology develops.
Limits and things to plan for
Passkeys are generally regarded as a step forward, but they are not magic.
- Account recovery still matters. If you lose every device that holds a passkey, you need another way back in. That recovery route, often an email address or phone number, can become the weakest part. Attacks such as SIM swapping target phone-based recovery, so keep recovery details secure.
- Device security matters more. Whoever can unlock your phone may be able to use your passkeys. A strong screen lock is part of the arrangement.
- Patchy support. Not every site offers passkeys yet, and some that do still allow passwords alongside them. You will probably use both for a while.
- Confusing options. The term is used loosely, and the prompts vary between systems. If you are unsure what a prompt is asking, stop and check before approving.
- Shared devices. On a computer used by several people, think carefully before saving a passkey to it.
Passkeys and other login methods
A passkey does not replace the need to think about the rest of your login setup. It can sit alongside two-factor authentication, and in many cases a passkey already combines two things, the device you hold and the biometric or PIN you use to unlock it. For accounts that do not support passkeys, unique passwords kept in a password manager, along with a second step, remain the sensible approach.
Trying one out
If you want to experiment, choose a low-stakes account that offers passkeys, create one when prompted, and then sign out and back in to see how it feels. Make sure you know how recovery works for that account before you remove any other sign-in method. Moving gradually lets you learn how passkeys behave on your own devices without risking being locked out.