What is a passkey?

A passkey is a pair of cryptographic keys that replaces your password. The private half stays locked on your phone, laptop or password manager; the public half goes to the website, which is welcome to it. Logging in means proving your device holds the private key without ever sending it — so there’s no secret in transit, and no reusable secret in the site’s database either.

That last clause is the whole point. But what is a passkey is the easy half of the question — the rest of this post is how the proof works, why it makes phishing the passkey itself structurally impossible rather than merely harder, and the three places attackers simply walk around it instead.

What is a passkey made of?

Two keys and some maths. When you create one, your device generates the pair, keeps the private key, and hands the public key to the site to store next to your username.

Logging in later, the site sends a challenge — a lump of random nonsense generated fresh for this attempt. Your device signs it with the private key and sends back the signature. The site checks it against the public key, and if the maths works out, you’re in.

Nothing you know ever leaves your device. There’s no string to type into the wrong box, reuse across sites, or lose in someone else’s breach.

The signature is single-use by construction, too: that challenge is burned on arrival, and the domain it was signed for is baked into the payload. Capture it and you’ve captured a receipt for a login that already happened.

None of this is new — it’s the same public-key cryptography that has secured SSH and TLS for decades. Passkeys are mostly the achievement of hiding all of it behind Face ID.

There’s a second-order benefit hiding in that. When a site holding passwords is breached, attackers leave with hashes to crack, which is the machinery behind the 2am “found in a data breach” email. When a site holding passkeys is breached, they leave with a pile of public keys — which are public. Your email address still ends up on the list, and that list still gets phished; there’s just no reusable secret in it any more.

Why phishing stops working

Here’s the part that matters. Every passkey is welded to the domain it was created for, and your browser checks that against the actual address bar before your device will sign anything.

Sites can stretch one passkey across a handful of their own domains by publishing a signed allowlist. What they cannot do is stretch it to a domain they don’t control, which is the entire ballgame.

Land on paypa1-secure-login.com and there’s no passkey for that origin. Not a warning, not a suspicious-looking prompt you might click through at 11pm — simply nothing to offer, because the credential you’re reaching for doesn’t exist at that address.

Compare that to the current state of the art. Adversary-in-the-middle kits sit between you and the real site and relay your password and your authenticator code in real time, which is why the 2FA setup you were told was enough is no longer quite enough.

Against a passkey they have nothing to relay. The signature is never produced in the first place — your browser derives the domain from the address bar, not from the page, and no passkey exists for the one the proxy is serving. Even if an assertion somehow appeared, the origin is baked into the signed payload, so the real site would throw it out on arrival.

A password manager refusing to autofill on a spoofed domain does something similar, and it’s excellent — but you can always override it by copying the password out and pasting it in yourself. With a passkey there’s nothing to copy. The refusal isn’t advice you can ignore; it’s arithmetic.

Your fingerprint doesn’t go anywhere

The most common misconception, worth killing early: when a site asks for Face ID or your fingerprint to use a passkey, the biometric is not sent to the site. It never leaves your device.

All it does is unlock the private key locally, the same way it unlocks your phone. The website receives a signature and learns nothing about your face, your thumb, or the PIN you used instead.

Which means a passkey is quietly doing two-factor work in a single step: something you have (the device holding the key) and something you are or know (whatever unlocked it). That’s why sites accepting passkeys tend to stop nagging you for a code afterwards.

The asterisk: this only holds if the site actually demands the unlock. Some implementations settle for a bare tap — presence, not verification — which quietly collapses your two factors back into one. You can’t tell from the outside, which is annoying, but if it asked for your face, you’re fine.

Synced, or stuck to one device

Passkeys come in two flavours, and the difference decides how annoyed you’ll eventually be.

Synced passkeys live in a keychain that follows you — iCloud Keychain, Google Password Manager, or a third-party vault — and show up on every device signed into it. This is what most people get by default, and it defuses the “lost my phone, lost my account” problem: the private key is still on the phone doing the signing, but an end-to-end-encrypted copy is escrowed with the keychain, ready to restore onto whatever you buy next.

Apple and Google can’t read that copy. It does mean your Apple or Google account is now the thing standing behind every passkey in it.

Device-bound passkeys never leave the hardware they were made on — a YubiKey being the usual suspect. Nothing syncs anywhere, so no cloud account sits in the trust chain and nobody can phish their way to your keys through Apple support.

The trade is that the key is now a physical object you can leave in a hotel. Lose it, lose the credential, no restore. Buy two, register both, keep the spare somewhere deeply boring — and know they fill up, because a modern YubiKey holds around a hundred passkeys, which sounds like plenty right up until it isn’t.

What a passkey doesn’t fix

Now the honest part, because three things survive the upgrade.

Most sites keep the password as a fallback. You can add a passkey and still have the old password sitting there, fully functional and phishable by anyone who asks nicely. Until you delete it — and until the site lets you — you’ve fitted a better front door to a house whose back door is unchanged.

Account recovery is the soft underbelly. Phishing-resistant login means very little if the “lost your device” flow is a code sent by email or SMS. Attackers don’t break the passkey, they walk around it — the Instagram takeover that began with a swapped recovery email is the shape of it — and it’s the criticism the industry still hasn’t answered well.

Session theft still works. A passkey protects the moment of logging in. It does nothing about malware that steals your session cookie afterwards, which is precisely what modern infostealers do. Browsers are starting to close this — Chrome now ties sessions to a key held in your machine’s security chip, so a stolen cookie is useless on the thief’s laptop — but it’s rolling out per-platform, and useless if the malware was already there when you logged in.

Where to keep them

If your entire life happens inside one ecosystem, good news: the built-in keychain is already fine, and you can skip to the last section feeling smug.

If it doesn’t — an iPhone and a Windows laptop, say — the cross-platform answer is a password manager that stores passkeys alongside everything else. 1Password and Bitwarden both do, and both will sync a passkey to whatever you’re sitting in front of.

It’s the same argument as keeping passwords in a vault rather than a browser: one place, every device.

And the lock-in worry is finally easing. There’s a real standard now for exporting passkeys between managers, which Apple and Android both ship, so moving your keychain to a different vault is a supported button rather than a hostage negotiation. Cross-device transfers are still catching up, but the direction of travel is right.

So should you turn them on?

Start with your email, tonight. Not your bank, not the eighty accounts you barely remember creating — the one mailbox that can mint a password reset for every other login you own.

It takes about thirty seconds, and while you’re in there, do the part everyone skips: check whether the old password is still sitting alongside the new passkey, and delete it if the site will let you. A passkey is only ever as strong as the weakest way back into the account.

Once your email is behind something a phishing page structurally cannot ask you for, most of the attacks on this blog stop working on you.