Passkeys are a way of doing public/private key-pair crypto to prove that you are in possession of the private key that corresponds to the public key that was registered with a site or service when you added the passkey to the account. The use of the passkey is often protected by biometrics like the fingerprint or facial recognition systems on your device but it doesn’t necessarily need to use biometrics at all if you don’t want to and you can instead use a passcode to unlock your device or password/passkey manager.

Basically instead of the normal way with passwords:

• You —password—> website
• Website verifies password matches, either directly to an actual stored password (bad) or through a hash they have stored

With passkeys you have:

• You <—challenge— website
• You sign the challenge with a private key that only you have
• You —signed challenge —> website
• Website verifies that the signed challenge corresponds to the public key you provided when you set up the passkey

In the password scenario, the website could be following best practices and hashing the password or it could just be storing them directly and insecurely. You have no idea what really goes on inside their systems. This means that due to reused passwords, a security breach at one site can mean problems for other sites, even if they didn’t do anything wrong.

In the passkey scenario, you’re not sending anything particularly sensitive to each site so it’s more secure.