Passkey
Problem
Passwords can be:
* reused,
* guessed,
* leaked,
* phished.
Humans are also bad at managing unique strong secrets for hundreds of services.
Solution — Passkeys
When you create an account or select “Add a passkey” in a website's security settings, your device or password manager creates a key pair. It protects the private key; the website stores the public key linked to your account.
At login, the website sends a random challenge. You unlock the passkey with your fingerprint, face, or device PIN; your device signs the challenge, and the website verifies the signature using your public key. The passkey is tied to the website's domain.
Core idea: passkeys replace shared password secrets with phishing-resistant public-key authentication.