What is a passkey?
A passkey is a discoverable public-key credential for signing in to an app or website without sharing a password with that service.
How it works and where it is used
1. How it works The device protects a private key while the service stores a public key. It signs a site-bound challenge. Biometrics or a PIN can unlock the device without sending biometric images to the site. 2. Applications and examples WebAuthn supports passkeys as a password alternative. Origin binding helps resist phishing; cross-device syncing depends on the provider.
Limits and good practice
3. Limitations and security Device loss, recovery and shared devices need planning. Passkeys do not cure stolen sessions or excessive app permissions. 4. Practical considerations Verify the real domain and arrange another recovery method. Services must implement origin checks, user verification and recovery securely.