Passkeys: sign in without a password
A passkey replaces the password with a key stored on your device. There is nothing to type, so there is nothing to phish.
What a passkey is
A passkey is a pair of cryptographic keys created for one website. The private half stays on your phone, computer or password manager; the website keeps only the public half. To sign in, you unlock your device the way you always do, with a fingerprint, your face or a PIN.
Your fingerprint or face never leaves the device. It only unlocks the key.
Why it resists phishing
A passkey is tied to the real address of the site it was made for. On a look-alike page your device has no key to offer, so there is nothing for a fake page to collect. A password, by contrast, can be typed anywhere.
There is also no shared secret on the server. If the site is breached, the attacker finds public keys, which are useless on their own.
How to start
Look for “Create a passkey” in the security settings of your email, your cloud storage and your main shopping or banking accounts. Passkeys saved in a password manager or in your Apple, Google or Microsoft account are synced to your other devices.
Keep your existing second step switched on until you are sure the passkey works on every device you use, and check that your account recovery options are up to date.
This note is our own plain-language summary. For the full guidance, read the original: https://fidoalliance.org/passkeys/
A fake page cannot ask for a key your device does not have.