What is a passkey, and is it better than a password?

A passkey uses public key cryptography rather than a shared secret. When you create one, your device generates a key pair, keeps the private key secured by your device's biometric or PIN, and gives the site the public key. Signing in means the site sends a challenge that only your private key can answer. Nothing secret is transmitted or stored on the site's servers, which eliminates the two failure modes that define password security: a database breach exposes public keys that are useless to an attacker, and a phishing site cannot collect a credential because passkeys are bound to the legitimate domain and simply will not respond to a lookalike.

The practical experience is usually faster than a password: you approve with a fingerprint, face scan, or device PIN. Passkeys sync across your devices through your platform's account or through a password manager that supports them, and cross-device sign-in works by scanning a code with your phone. Adoption is broad and growing across major platforms and services, though coverage is still uneven enough that you will keep passwords for some accounts for a while.

Two limitations worth understanding. Passkeys tie into a platform or password manager ecosystem, so recovery depends on retaining access to that account or device, which makes your recovery options and any backup method genuinely important to set up before you need them. And because adoption is partial, many sites that support passkeys still allow password login as a fallback, which preserves the phishing vulnerability unless you can disable the password entirely. The sensible approach today is enabling passkeys where offered, particularly on email and financial accounts, keeping a password manager for everything else, and maintaining strong second-factor authentication on any account still using a password.