Passkey (FIDO2 sign-in)

A passkey is a password that does not know it is one. You never see it, you cannot leak it, and a fake login page cannot use it.

The short answer

A passkey is a sign-in credential built on FIDO standards. Instead of a password, your device holds a private key for each account, and the website stores only the matching public key [1][2]. You approve the sign-in the same way you unlock your device, for example with a fingerprint, face or PIN [1]. Passkeys resist phishing because the key only works for the site that created it [2][3]. Our assessment: turn them on where they are offered, but plan your recovery first.

How it works

1. A key pair per account. A passkey is a public/private key pair bound to your account on one website. The private key sits in an authenticator, which may be built into your device, a hardware key or a credential manager. The website stores the public key [2]. You do not invent or remember anything, so nothing weak can be chosen, and keys are never reused across sites [2].
2. The sign-in. The website sends a challenge. The authenticator finds the key pair, you unlock it with a biometric or PIN, and it signs the challenge. The service checks the signature with the public key and signs you in [4][2].
3. Why phishing fails. A passkey is scoped to the website's domain (the relying party ID), and the signed response includes the origin. Code on a look-alike page such as examp1e.com cannot use the passkey made for example.com [2][3]. A server breach leaks no private key, as the server holds only public keys [2].
4. Device-bound or synced. A device-bound passkey never leaves its authenticator, so you register a second one as a backup. A synced passkey is copied to your other devices through a provider's sync service, which makes recovery easier but ties your access to that provider and its security [5][3]. Synced passkeys do not support attestation [4], and NIST does not allow syncable authenticators at assurance level AAL3 [3]. The US federal playbook calls synced passkeys well suited to most consumer use cases [6].
5. What passkeys do not fix. They do not stop an attacker who already controls a session from adding their own passkey, an insecure recovery process, or a compromised device or sync account [3][2].

A practical example

You enable a passkey on your email account on the laptop. The service stores the public key, and your laptop or password manager holds the private key. You then add the phone as a second authenticator and test the sign-in from there. If the laptop dies, you still get in, and the weak spot left is the recovery path, which you check next. This is a generic walk-through. We have not recorded which of our accounts offer passkeys, so we claim none.

Checklist

• Enable passkeys on your email account and password manager first, because other resets run through them.
• Register at least two authenticators, so one lost device does not lock you out [3].
• Find out where each passkey lives: device, password manager or hardware key [4].
• Protect the sync provider's account with a strong sign-in, since synced passkeys depend on it [3][5].
• Review the recovery options and remove weak ones such as SMS or old email addresses [3].
• Test the sign-in on a second device before you delete any password.