What Are Passkeys and How Do They Replace Passwords?
Passkeys are a phishing-resistant replacement for passwords, built on public-key cryptography. Here is what a passkey is, how it works, and why it is more secure.
- A passkey is a cryptographic key pair tied to your device and a specific website — there is no secret to type, reuse, or leak.
- The private half never leaves your device; the website only ever stores the public half, which is useless to an attacker on its own.
- Passkeys are phishing-resistant by design: they refuse to authenticate to a site that is not the one they were created for.
- You unlock a passkey the way you unlock your device — a fingerprint, face, or PIN — so signing in is faster than a password and far harder to steal.
The short answer
A passkey is a replacement for a password that uses public-key cryptography instead of a shared secret. When you create a passkey, your device generates two mathematically linked keys: a private key that stays on your device and a public key that the website stores. To sign in, your device proves it holds the private key without ever revealing it. There is no password to type, remember, reuse, or have stolen.
If passwords are a secret you and a website both have to know, a passkey is a lock-and-key system where you keep the only key and the website only keeps the lock.
Why passwords were always the weak point
Passwords fail not because people choose bad ones, but because of what a password fundamentally *is*: a secret that has to be shared with a server and re-entered every time. That design creates four unavoidable problems.
- They can be phished. If an attacker builds a convincing fake login page, you can be tricked into typing your password straight into it.
- They can be reused. People reuse passwords across sites, so one breach unlocks many accounts.
- They can be leaked in bulk. When a server is breached, the attacker walks away with credentials for everyone at once.
- They put the burden on you. Length rules, rotation, and "special characters" all push the security work onto the human, who is the part of the system least able to do it.
Two-factor authentication patches some of this, but it adds friction and most common forms of it can still be phished. Passwords are a 1960s idea carrying a load they were never designed for.
How a passkey works, step by step
The mechanics are simpler than they sound:
- Creation. When you set up a passkey for a site, your device generates a key pair. The private key is stored securely on the device (often in a hardware security chip) and the public key is sent to the website. The site can store that public key in the clear — on its own it cannot be used to sign in as you.
- Signing in. The website sends your device a one-time challenge. Your device signs that challenge with the private key and sends back the signature. The website verifies it with the public key it already has. Match confirmed, you're in.
- Unlocking. Before your device will use the private key, it asks you to prove it's really you — usually a fingerprint, face scan, or device PIN. That biometric never leaves your device; it just unlocks the key locally.
At no point does a reusable secret travel across the network. The challenge is different every time, and the only thing sent back is a signature that proves possession of a key without exposing it.
Why passkeys are phishing-resistant
This is the part that matters most. A passkey is bound to the exact website it was created for. Your browser and operating system enforce that binding. If you land on a look-alike phishing site, your device simply will not offer the passkey, because the site's identity does not match. There is nothing for you to accidentally hand over, because there is no secret to hand over in the first place.
That single property eliminates the most common way accounts get compromised today. You cannot be tricked into giving away something you do not have.
Common questions, answered honestly
Are passkeys safe if I lose my device? Yes — passkeys are typically synced through your platform's secure keychain (Apple, Google, Microsoft) or a password manager, so a new device can recover them after you authenticate. Many systems also let you register more than one device or a hardware security key as backup.
Does the website see my fingerprint or face? No. Biometrics are used only to unlock the key on your device. The website never receives or stores them — it only ever sees a public key and a signature.
Are passkeys harder to use than passwords? They are usually *easier*. There is nothing to type and nothing to remember; signing in is the same gesture you already use to unlock your phone.
Passkeys in social and community apps
Everything above applies anywhere passkeys are used, but they are an especially good fit for social platforms, where a stolen password can mean a hijacked identity and reputation. DeadArk uses passkeys as a first-class way to sign in for exactly this reason. If you want the platform-specific version of this story, see What Is a Passkey Social App? and the head-to-head in Passkeys vs Passwords for Social Networks.
The definition, stated plainly
A passkey is proof you hold a key, not a secret you have to share. That one change closes the door on phishing, reuse, and bulk leaks all at once.
Frequently asked questions
What is a passkey in simple terms?
A passkey is a replacement for a password that uses a pair of cryptographic keys. A private key stays securely on your device and a public key is stored by the website. You sign in by proving you hold the private key, so there is no secret to type, reuse, or steal.
How do passkeys replace passwords?
Instead of sending a shared secret to a server, your device signs a one-time challenge with a private key that never leaves the device. The website verifies it with the matching public key. Nothing reusable crosses the network, so the usual ways passwords fail no longer apply.
Are passkeys safe and phishing-resistant?
Yes. A passkey is bound to the exact website it was created for, so your device will not offer it to a look-alike phishing site. Because there is no secret to hand over, you cannot be tricked into giving one away.
What happens to my passkeys if I lose my device?
Passkeys are usually synced through your platform keychain or password manager, so a new device can recover them after you authenticate. You can also register multiple devices or a hardware security key as backup.
More in Definitions
Doxxing is publishing someone's private information to expose or intimidate them. Here is what it is, how it happens, and practical ways to protect your community.
The fediverse is a network of independent social servers that talk to each other, so no single company runs it all. Here is how it works, in plain English, and its trade-offs.
Your social graph is the map of who you're connected to and how. Here is what it is, why platforms guard it so closely, and why it should belong to you.
DeadArk is a local social network for people, communities, businesses, projects, publications, and institutions to connect through shared interests and place. Learn more at deadark.com.