A passkey is a modern login method that uses cryptography instead of a password—often unlocked by your face, fingerprint, or device PIN.
Why it matters
- Passwords get reused, phished, and leaked.
- Passkeys are designed to be resistant to phishing.
- They can reduce reliance on SMS codes.
Key points
- Passkeys use public-key cryptography.
- Your device keeps a private key; the site stores a public key.
- Logging in requires your device + a local unlock (biometric/PIN).
- Many passkeys can sync across devices (depending on platform).
The basic concept (in plain language)
A password is a secret you type and send to a website. A passkey is a secret your device never shares. The site asks your device to prove it has the secret—without revealing it.
How a passkey login works
- You create a passkey for a website/app.
- Your device generates two keys:
- Private key (stays on your device)
- Public key (saved by the website)
- When you log in:
- The website sends a challenge.
- Your device signs it with the private key.
- The website verifies the signature using the public key.
Why passkeys are harder to phish
With passwords, a fake website can trick you into typing the secret. With passkeys, your device typically checks the domain/app identity before completing the login—so the private key isn’t exposed to phishing pages.
Practical tips
- Use passkeys when offered (especially for email and important accounts).
- Keep a strong device PIN and enable device security.
- Set up recovery options (backup codes, recovery email/contacts).
Key takeaways
- Passkeys use cryptography instead of shared secrets.
- Your private key stays on your device—websites never receive it.
- They are generally resistant to phishing and credential stuffing.
- Syncing can make them easier across devices.
- Recovery setup is still important if you lose devices.
