Passkey

A passkey is a passwordless login credential built on the FIDO2 and WebAuthn standards. Your device keeps a private key and the website stores only the matching public key, and you unlock the private key with a biometric or device PIN.

Why it matters

There is no shared secret to steal from a server breach, and a passkey is bound to the real domain, so a fake lookalike site cannot trigger it. That makes passkeys resistant to phishing in a way passwords and one-time codes are not. Many platforms sync them across your devices through their keychains or a password manager.

Example

On a supported site you click Sign in with a passkey, your phone asks for your fingerprint, and you are in. The site never receives a password or reusable secret, only a signed challenge.

Common mistakes

• Assuming biometric data is sent to the website. It stays on your device.
• Not setting up a recovery method for when you lose all your devices.
• Expecting every site to support passkeys. Many still need a password fallback.

Related

• Public key
• Two-factor authentication
• Phishing
• Password manager

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.