A passkey is a cryptographic key pair that replaces your password: the private half stays with you, and the website keeps only the public half, which is useless to an attacker.
Introduction: why passwords fail
A password is a shared secret. You and the website both know it, so anyone who tricks you into typing it on a fake page, or steals it from the site’s database, can sign in as you. Reusing the same password across sites turns one breach into many.
Passkeys remove the shared secret. Instead of typing something you know, you prove you hold a private key by unlocking your device with a fingerprint, face scan or PIN. The approach is built on open standards from the FIDO Alliance and the W3C, chiefly WebAuthn (the browser API) and CTAP (the protocol between a device and an external authenticator such as a security key). Because the standards are open, Apple, Google, Microsoft and independent password managers can all support them.
How passkeys work
Signing in with a passkey means signing a one-time challenge; no secret is ever sent to the website. It happens in three steps:
Registration. Your device or passkey manager creates a key pair for that site. The public key goes to the site once. The private key stays on your side, held in secure hardware where available.
Challenge. When you sign in, the site sends a random, one-time value.
Signature. You approve with a fingerprint, face scan or PIN. Your device signs the challenge with the private key, and the site checks the signature against the public key it already holds.
Because the site stores only public keys, a database breach yields nothing an attacker can replay. The single gesture also covers two factors: the device you have, plus the biometric you are or the PIN you know (Corbado).
This is different from the fingerprint unlock already on your phone. Local biometrics only unlock something on one device and never talk to a server. A passkey authenticates you to a service, works across devices, and is tied to the real website’s domain.
Two terms come up often: WebAuthn is the browser API that websites call, and CTAP is the protocol between your device and an external authenticator such as a security key. The credential that results from all of this is the passkey.
Why passkeys resist phishing and breaches
Phishing resistance is built into the protocol, so it does not depend on you spotting a fake site. When a passkey is created, it is locked to the real site’s domain, known as the Relying Party ID. At sign-in, the browser checks that the page you are on belongs to that domain. On a look-alike site, even a pixel-perfect clone, the check fails and the passkey is simply never offered (Corbado).
That is the gap other methods leave open. SMS codes, authenticator-app codes and push approvals can all be relayed in real time by a fake site that proxies the login, because nothing ties them to the site you are actually on.
Two caveats are worth knowing:
Attackers shift to the next-weakest path. Once sign-in itself cannot be phished, account recovery becomes the new front door and needs to be hardened.
Passkeys are not yet everywhere. In the FIDO Alliance’s 2026 research, 57% of organizations still relied on phishable methods for employees’ primary day-to-day sign-in.
Device-bound vs synced passkeys
Both are passkeys under the FIDO standard; the difference is where the private key lives and whether it can move. Synced passkeys trade some control for reach and easy recovery, while device-bound passkeys give up convenience for tighter control and proof of what created the key (Corbado).
Synced passkey
Device-bound passkey
Where the private key lives
A passkey manager such as iCloud Keychain, Google Password Manager or 1Password, end-to-end encrypted and copied to your other devices
Inside one authenticator, such as a hardware security key or a platform chip like a TPM, and never leaves it
If you lose the device
Passkeys return when you sign in to the provider account on a new device
Gone, unless you enrolled a backup authenticator in advance
Attestation (proof of which authenticator model made the key)
Not available
Available
Key can be exported
Yes, in encrypted form
No
Highest NIST SP 800-63B-4 level
AAL2
AAL3 (synced credentials are ruled out)
Main risk
Inherits the security of the cloud account and its recovery process
In practice most consumers get synced passkeys by default, and that is the right target for almost every consumer service. Organizations often run a mix, with synced passkeys for the general workforce and device-bound keys for privileged accounts. One enterprise concern is that a work device signed in to a personal cloud account could sync work credentials outside the company’s control (The Hacker News), which is why some organizations insist on hardware security keys such as those described by Yubico.
A note on terms: Apple, Google and Microsoft introduced “passkey” in 2022 for syncable credentials, and in 2023 the FIDO Alliance applied the word to all FIDO credentials, so a vendor saying “passkey” may mean either type (RSA). Asking which one is meant avoids confusion.
Cross-device sign-in and recovery
If you need to sign in on a computer that has no copy of your passkey, you can scan a QR code with the phone that holds it and approve there. This is called cross-device authentication, and it works across ecosystems (Corbado).
Recovery depends on the type:
Synced passkeys come back with your provider account on a new device, so protect that account with strong sign-in of its own.
Device-bound passkeys do not sync, so register a second authenticator, such as a spare security key kept somewhere safe, before you need it.
Either way, keep more than one way to get back in, and treat the recovery path as part of your security, since it is where attackers tend to turn next.
Getting started and what to expect
Passkeys have reached mainstream scale: the FIDO Alliance estimated 5 billion passkeys in use in May 2026. Its survey of 11,000 consumers in ten countries found 90% aware of passkeys, 75% having enabled one on at least one account, and 49% using them regularly when available.
To start using them:
When a site or app offers to create a passkey after you sign in, accept; it takes one fingerprint or face scan.
Use the passkey manager you already trust, and secure that account with strong sign-in.
Add a backup, such as a second device or a spare security key, for accounts that matter.
Expect a password fallback on many sites for now, since adoption is still uneven.
On reliability, the FIDO Passkey Index, as summarized by Corbado, puts passkey sign-in success at 93% against 63% for other methods.