What is a passkey and is it better than a password?

The details

Passkeys are tied to the real website’s domain, so a phishing page cannot trick your device into using them. The website only stores a public key, so a breach of the site does not leak anything an attacker can sign in with.

Keep a recovery method set up, such as a synced passkey in your password manager or a second device, in case you lose the phone that holds it.

Terms explained

Passkey

A passkey is a phishing-resistant sign-in credential based on public-key cryptography, stored on a device or in a password manager and unlocked with a biometric or device PIN.

Password manager

A password manager is an app that generates, stores and fills unique passwords and passkeys, protected by one strong master password and usually MFA.

Phishing

Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.

Sources

• FIDO Alliance: Passkeys
• CISA: More than a Password (MFA)