Passkey

A passkey allows a person to sign in to a supported website or application using their device unlock method, such as a PIN or biometric check. The underlying credential uses public-key cryptography: the service holds a public key, while the private key is protected by the passkey provider. The website does not receive the user’s fingerprint or face data during authentication.

Passkeys resist common phishing attacks because authentication is bound to the legitimate service rather than to a password that can be typed into a look-alike page. Some passkeys sync securely across a user’s devices, while device-bound credentials remain on a particular authenticator. The appropriate choice depends on the service and its security requirements.

For a site owner, offering passkeys requires supported authentication infrastructure, sensible account recovery, and clear registration flows. A passkey is not a substitute for keeping recovery channels and administrator access secure. It is a sign-in mechanism, not simply a password stored in a browser.