What it means
Passkeys are built on the FIDO and WebAuthn standards. At sign-in, your device proves it holds the private key after you unlock it with a biometric or PIN. No shared secret travels to the service, so there is nothing to phish or leak. This differs from multi-factor authentication, which adds a second step to a password instead of replacing it.
Why it matters when you buy software
Passkey support varies by vendor and sometimes by plan tier. Check whether a product accepts passkeys for sign-in, whether they work alongside single sign-on, and how access is recovered after a lost device. A password manager that stores and syncs passkeys is a separate feature from a service that simply accepts them.
How it works in practice
Setup takes one confirmation on a device that is already signed in. At the next login, the service sends a challenge, the device signs it after a biometric check, and access is granted. Passkeys can sync through a platform account or a password manager, and a phone can approve a sign-in on another device.
See also: Passwordless authentication, Directory sync and the glossary index.