What is a passkey?
In short
A passkey is a sign-in credential that replaces a password with a pair of cryptographic keys. The app keeps only the public key; the private key stays on the person's device or in a credential manager. Signing in uses a fingerprint, face, PIN or device unlock, and a passkey can't be phished or reused.
How passkeys work
When someone sets up a passkey for an app, their device creates two linked keys. The public key is sent to the app and stored there. The private key never leaves the device or credential manager that created it.
To sign in, the app sends a one-off challenge. The device asks the person to confirm it is them, with a fingerprint, face scan, PIN or screen lock, then signs the challenge with the private key. The app checks the signature against the public key it holds. No secret is typed, sent or stored by the app.
Passkeys are built on the FIDO2 and WebAuthn standards, so the same approach works across browsers, operating systems and apps that support them.
Why passkeys resist phishing
A passkey is tied to the web address of the app it was created for. A fake sign-in page on a lookalike address can't use it, so there is nothing for an attacker to collect. And because the app only holds a public key, a breach of the app's database gives attackers nothing they can use to sign in elsewhere.
Passkeys and passwords compared
Nothing to remember: people confirm with a fingerprint, face or PIN instead of typing a password.
Nothing to reuse: every passkey is unique to one app, so one breach can't spread to other accounts.
Nothing to phish: a passkey only works on the real site it was made for.
Nothing to steal from the app: the app stores only the public key.
Synced and device-bound passkeys
Synced passkeys are kept in a credential manager, such as a password manager or a phone platform account, and are available on each device signed in to it. Device-bound passkeys stay on one piece of hardware, such as a security key, and cannot be copied.
The challenge for businesses
Passkeys are a big step up from passwords, but when each person sets them up for themselves they create new problems for IT:
Work passkeys end up on personal phones, personal password managers and browser profiles.
IT can't easily see which apps use passkeys, or who holds them.
Shared accounts are hard to move to passkeys, so they often stay on shared passwords.
When someone leaves, a passkey synced to their personal account may still work.
Managing passkeys centrally, linked to the corporate directory, keeps the security benefits without losing control.
How My1Login helps
My1Login creates and stores passkeys for external web apps, so they're held under IT's policies rather than on personal phones. Discovery shows where passkeys saved outside My1Login are in use and which apps support them, people can keep several passkeys per app, and with the enterprise password manager passkeys can be shared without being exported. Because passkeys are tied to the directory sign-in, a leaver loses them the moment their account is disabled.