Passkeys, explained without the jargon

A passkey is a pair of cryptographic keys. The private key stays on your device and never leaves it; the website only stores the matching public key. To sign in, your device proves it holds the private key after you unlock it with a fingerprint, face scan or PIN. There is no secret on the server that can be leaked in the usual sense.

Passkeys are also bound to the real address of the site, which makes them resistant to phishing pages that merely look right. Most platforms can sync them through their own keychain, so a new phone does not mean starting over. Keep at least one recovery method for your account, and do not remove your password until you have tested the passkey on a second device.