Lesson 3.2

3.2: What a Passkey Actually Is

10 minutes

What a Passkey Actually Is

A passkey is a pair of mathematically linked keys. When you create one for a site, your device generates both halves: a public key, which the site keeps, and a private key, which never leaves your device. Not during setup, not during sign-in, not ever.

A useful way to picture it: the site keeps an open padlock, and only your device holds the key that fits it. Signing in means your device proving, right there on your hardware, that it holds the key. The site sends a fresh mathematical challenge, and only the private key can answer it. The padlock’s owner never needs to see the key to know it fits.

So where does your fingerprint or face come in? One step earlier than most people assume. The biometric never goes to the website. It unlocks your device’s use of the private key, locally — the same check that unlocks the phone itself. All the site learns is “the right device approved this, with its owner present.” Your fingerprint never leaves the hardware, and there is no biometric database to breach, because none exists.

The sign-in, step by step

1. The site issues a challenge. A random number, fresh every time: "prove you hold the key by signing this."
2. Your device asks you to approve. Fingerprint, face, or PIN, checked by your device and never transmitted.
3. The private key signs the challenge. On your hardware. The key itself stays put.
4. The site verifies the signature with its public key. The padlock confirms the fit, and you're in. Nothing was typed, and nothing a thief could reuse was sent.

Why there is nothing to phish

The property that puts passkeys at the top of the ladder is stronger than “hard to steal”: a passkey is cryptographically bound to the real site’s address. Your device created that key for paypal.com, and it will only ever answer challenges from paypal.com. A lookalike at paypa1-secure.com can’t ask for the wrong site’s key. The browser won’t even present it.

Compare that with a password for a moment. A password’s security depends on you noticing the fake page — the manager’s autofill silence from 2.3 helps, but a rushed human can still copy a password over by hand. A passkey takes the human out of that decision entirely. There is no code to read to a caller, nothing to type into the wrong box, no secret you could surrender under pressure. Phishing doesn’t just get harder. It stops being possible.

The Module 1 threats evaporate along with it: nothing to reuse across sites, nothing to leak in a cracked database. When a site holding your passkey is breached, the attackers get your public key — an open padlock. They can copy it all they like. It opens nothing.

Why everyone shipped it at once

You may have noticed passkeys appearing everywhere within a couple of years: Apple, Google, and Microsoft accounts, Amazon, GitHub, banks. That’s no coincidence. It’s a rare industry-wide agreement on a shared standard (FIDO2/WebAuthn, built by an alliance those competitors joined together). One design, one behavior, every platform. It’s also why your passkeys sync across your Apple or Google devices, and why password managers can store them too.

Enough theory. On the next page, you’ll create one and watch every step of this lesson happen for real.