Passkey

A passkey is a public-key credential that replaces the password for signing in. When a user registers, their device generates a key pair, keeps the private key protected by the device's own unlock (fingerprint, face, PIN), and gives the site the public key. Signing in means the site sends a challenge and the device returns a signature. Nothing reusable is transmitted, so there is no shared secret to leak in a breach, no password to reuse across sites, and no code for a user to read out to an attacker. The property that matters most is origin binding. A passkey is registered against a specific site and the browser will not offer it to a lookalike domain, which removes the phishing route that survives even app-based one-time codes. Passkeys are typically synchronised through a platform or password-manager account so a lost device does not mean a lost account, while device-bound hardware keys trade that convenience for stronger isolation; both use the same underlying web authentication standard. For product teams the work is mostly around the edges. Passkeys must coexist with existing password and SSO paths during a long transition, users need a way to enrol on a second device and to remove a lost one, and the account recovery flow becomes the weakest link — if a forgotten passkey falls back to an emailed link, the security of the account is the security of that mailbox. Enterprise buyers will also ask how passkey enrolment interacts with their identity provider rather than replacing it.