Passkeys, explained: what changes and what doesn't

A passkey is a cryptographic key pair created for one website. The site keeps the public key. The private key stays on your device, unlocked by your fingerprint, face, or device PIN.

What passkeys fix

• Phishing. A passkey is bound to the real site's domain. A look-alike site can ask, but your device has nothing to give it.
• Password reuse. Every passkey is unique, so one breached site exposes nothing about the others.
• Server breaches. The site stores only a public key. Stealing it doesn't let anyone sign in.

What they don't fix

• Account recovery. If the fallback is still an emailed reset link, the account is only as strong as that inbox.
• A compromised device. Malware running as you can use your sessions after you sign in.
• Session theft. A stolen session cookie skips the sign-in step entirely.

What to do

1. Add a passkey to your email and password manager first.
2. Keep a second sign-in method you control, such as a hardware key or printed recovery codes.
3. Once the passkey works, remove SMS as a fallback where the site allows it.

Passkeys remove the most common way accounts are taken over. They are worth turning on today, as long as you also look at how each account is recovered.