🔐
Passkey
Authentication
Passwordless credential based on public-key cryptography, typically stored on a device or synced securely.
Definition
A passkey is a phishing-resistant, public-key credential used for passwordless authentication (often via WebAuthn/FIDO2). The private key stays on the user’s device (or in secure sync), and the service stores only a public key.
In plain English
Passwordless credential based on public-key cryptography, typically stored on a device or synced securely.
Why this matters
Why it matters: It mitigates password reuse and credential theft, and limits account takeover via phishing.
Example
Example: A user authenticates with a device-bound key and biometric/PIN unlock, and the server verifies a signed challenge.