A passkey uses a public-key credential created for a specific service. The private portion remains protected by the user’s device or credential provider, while the service stores a public key used to verify login signatures.
Passkeys are bound to the real service
The browser or operating system checks the website identity before using the credential. This can make a well-implemented passkey more resistant to credential phishing than passwords and one-time codes.
Biometrics usually unlock a local credential
The service normally receives a cryptographic signature, not a copy of the fingerprint or face data used on the device.
Account recovery still needs scrutiny
A secure login method can be undermined by a weak recovery process. Users should understand device syncing, backup credentials, lost-device recovery, and which support checks can reset the account.
Portability depends on the credential provider
Before relying on passkeys alone, check how they sync, export, recover, or work across the user’s devices.
Sources
Educational information, not investment advice.