Glossary
Passkey
A passkey is a credential based on a key pair rather than a shared secret: the private key stays on the user's device or in their password manager, and the site only ever holds the public half. Signing in means the device proving it holds the private key for that specific site. Because nothing reusable is ever transmitted, two whole categories of problem — password reuse and phishing — stop applying rather than being mitigated.
Why phishing stops working
A passkey is bound to the site's domain, and the device will not use it for a different one.
So a convincing replica of your login page cannot obtain anything: the user's device simply declines to offer the credential.
That is a structural property rather than vigilance. It does not depend on the user noticing the domain is wrong.
The same binding is why a passkey cannot be read out and typed somewhere, which is how most credential theft actually happens.
Why reuse stops applying
A separate key pair is generated per site, so there is nothing shared to reuse.
A breach of one site exposes public keys, which are not useful anywhere including on the site they came from.
Which removes the premise of credential stuffing entirely rather than raising its cost.
It also removes the password-strength question, because there is no password for anyone to choose badly.
What it changes about recovery
The private key lives on a device or syncs through a password manager, so losing access to both is losing access to the account.
Which makes account recovery the new weak point: a recovery flow falling back to email is only as strong as that mailbox.
Syncing across a platform's ecosystem solves most of it and ties the account to that ecosystem, which is a trade worth making deliberately.
Registering more than one passkey per account — a phone and a hardware key — is the practical answer, and it needs an interface that invites it.
What is observable from outside
Public mentions of passkeys or multi-factor authentication on the site, which is a mention and not an enforcement.
Whether federated sign-in is offered alongside, since the two often arrive together.
Whether a public login entry point exists at all.
Whether any of it is actually available, let alone required, cannot be established without an account — and no credential is ever submitted.
What a site has to store, and what it does not
A public key per credential, which is not secret and is useless to anyone who obtains it.
A credential identifier, so the right key can be requested at sign-in.
A signature counter where the authenticator provides one, which can indicate a cloned credential.
No password hash, no salt, and nothing whose disclosure would let anyone sign in — which changes what a breach of the user table actually costs.
Frequently asked questions
- Is a passkey the same as two-factor authentication?
- It replaces the password rather than adding to it. Most implementations require a device unlock, so the single step already combines something you have with something you are.
- What happens if I lose my device?
- That is why recovery matters more with passkeys, and why registering more than one per account is the practical answer. A recovery flow falling back to email is only as strong as the mailbox.
- Does a site breach expose my passkey?
- It exposes the public half, which is not useful to anyone. The private key never leaves your device or your password manager.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website