Security
What is Passkey?
A passkey is a WebAuthn credential stored on a user's device or in their platform keychain, unlocked by biometrics or a device PIN. It replaces a password with a key pair: the site stores a public key, and the private key never leaves the device.
Passkeys are commonly synced through a platform keychain, which makes them recoverable across a user's devices — a meaningful usability difference from hardware security keys, and a meaningful change in the threat model, since the sync provider becomes part of the trust path.
The security property people most often misstate is that passkeys prevent phishing. More precisely: they prevent credential phishing. A user can still be socially engineered into approving a transaction they should not approve. What they cannot do is hand a working credential to an attacker.
Related
Definitions are educational and general. Nothing here is financial, legal or tax advice, and regulatory descriptions summarise frameworks that change — check the current rules for your jurisdiction before relying on them.