Passkeys

In short: Passkeys replace passwords with a cryptographic key pair. You sign in with fingerprint, face or device PIN.

In more detail: On creation a private key (stays on the device or in the password manager) and a public key (held by the service) are generated. On sign-in the device confirms a challenge with the private key. No secret is transmitted that could be intercepted or guessed.

In Depth

• Phishing-resistant: The passkey only works on the real web address.
• Standard: WebAuthn/FIDO2.
• Synchronisation: Passkeys can be copied to several devices through Apple, Google or password-manager accounts.
• Recovery: Loss of the device must be covered by account recovery.
• Switching: Many services offer passkeys in addition to the password.

See also: Two-factor authentication (2FA), Asymmetric encryption