Passkey

Think of your front door key. Anyone can see the lock on the door, but the key that opens it exists only in your pocket. No matter how long you stare at the lock, you can't work out the shape of the key.

When you create a passkey, your device makes two matching values at once. The public key, the lock, is sent to the site you'll log in to, and the site stores it. The private key, the key itself, stays locked inside your smartphone or laptop.

When you log in, the site throws out a different challenge each time. Your device signs that challenge with the private key and sends back the answer, and the site checks it against the public key it kept.

The important part is that the private key never travels to the site. Even if a server is breached and everything stored there leaks out, what a thief gets is not the key, only the lock.

A phishing site copies a real bank's screen exactly. A one-letter difference in the address is hard to catch with human eyes. A password is something you type by hand, so if you're fooled into typing it once, it's gone for good.

A passkey works differently here. The key stored on your device is tied to the site it belongs to. If the address doesn't match, your device won't create a signature at all.

Even when a person is fooled by their eyes, the device compares the address character by character. There's simply no value to hand over by mistake, and that's the biggest strength of a passkey.

For the same reason, programs that secretly record your keystrokes have nothing to catch. There are no characters typed by hand, so there's nothing left to steal. And because a separate key is created for each site, a breach at one place is unlikely to spread to your other accounts.

It's easy to think your fingerprint or face is sent to the site. But unlocking is the device checking for itself whether you're allowed to use the private key locked inside it. Your fingerprint data stays in the device's secure area, and all the site receives is a single signature value.

Many people also worry about losing a device. Today's passkeys are often synced, encrypted, to a cloud keychain tied to your account. Some passkeys, like those on security keys, are bound to a single device and don't sync. When you sign in to your account on a new device, the key follows you, and you can also approve by scanning a QR code with a passkey on another device.

Still, many sites don't support passkeys yet. So for now, passwords and passkeys are used side by side, in a transition period. Even if you use passkeys, setting up a way to recover your account ahead of time is still important.