A password is a secret that you and the website both know. That is its basic weakness: anyone who learns it, whether from a data breach or a convincing fake login page, can use it. A passkey removes the shared secret. Instead of typing something the site can store and lose, you prove that your device holds a private key, and the site never sees it.
What happens when you sign in
Passkeys are built on the FIDO Alliance’s authentication standards and the World Wide Web Consortium’s WebAuthn specification. When you create a passkey for a service, your device generates a pair of linked cryptographic keys. The service stores the public key. The private key stays on your device.
At sign-in, the service sends a challenge, and your device signs it with the private key. Your fingerprint, face scan or PIN does one job only, which is to unlock the key on the device. The FIDO Alliance says biometric information and processing “continues to stay on the device,” and the server receives only confirmation that the check succeeded.
The result is that the website holds nothing a thief could use to sign in as you. A breach of the service exposes public keys, which are useless on their own.
Why a fake site gets nothing
Phishing works by getting you to type a secret into the wrong place. With passkeys there is nothing to type, and the credential is scoped to the real site. The WebAuthn specification says a credential, once created, “can only be accessed by origins belonging to that Relying Party,” with browsers and authenticators jointly enforcing the rule. A lookalike domain is a different origin, so the passkey simply does not respond. The FIDO Alliance describes phishing resistance as a core design goal.
That property is why US security agencies steer organizations toward this kind of authentication. CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication, and its guidance says the protocol “will block the attempt” when a user is tricked into visiting a fake website. Our comparison of multi-factor authentication methods shows how that stacks up against codes and push approvals.
Syncing, and what it costs
A passkey can be device-bound, living on a single phone, computer or hardware security key, or synced across a person’s devices through an encrypted cloud account. Syncing is what makes passkeys convenient: a new phone can pick them up. The FIDO Alliance says passkey syncing is end-to-end encrypted.
It also changes the risk. The Alliance acknowledges that passkeys backed up with a password or synced across devices are more exposed to theft than device-bound ones, and it treats device-bound passkeys on hardware keys as the highest-assurance option. The US National Institute of Standards and Technology reflects the same trade-off in its digital identity guidelines: synced passkeys can meet its second assurance level, but its highest level prohibits exporting keys, so synced passkeys cannot reach it.
What passkeys do not fix
Strong sign-in does not make an account unbreakable.
Recovery is the usual soft spot. If an attacker can persuade a help desk or exploit a weak recovery flow, the strength of the passkey is beside the point. Device security matters as well, because anyone who can unlock your phone may be able to use what is on it. And support is still uneven, so passwords will linger on many services for some time. The FIDO Alliance reports, from a survey it commissioned in 2024, that 53 percent of people had enabled passkeys on at least one account. That figure comes from the standards body that promotes the technology, so it is best read as an indication of momentum.
Getting started without locking yourself out
There is no need to switch everything at once. Start with the accounts that unlock the others, mainly your email, then banking and cloud storage. Decide where your passkeys will live, in your phone or computer’s built-in storage or in a password manager that supports them, and keep a second way to sign in, such as another passkey or a spare security key. Leave the old password in place until the passkey has worked a few times, and read each service’s recovery options before you need them.
Attackers know recovery is the next target, and the messages they use to exploit it are increasingly polished, as our piece on AI-assisted phishing describes.
