ELI5: how passkeys work
// explanation
What is a passkey?
A passkey is a special way to prove you own an account without typing a password [1]. Instead of remembering a secret word, your phone or computer remembers a pair of special codes—one that's private (like your secret) and one that's public (like your mailbox address) [3].
Why do we need passkeys?
Passwords are like locks that thieves can guess or steal, but passkeys use math magic to prove it's really you [1]. When you try to log in, your device uses its private secret code to prove "yes, this is really me" without ever showing anyone the actual secret [4].
How do you use a passkey?
Instead of typing a password, you just use your fingerprint, face scan, or a PIN on your phone when you want to log in [5]. Your device does the hard math work behind the scenes to prove you're you [4].
Where does it get stored?
Your private key (the secret part) stays safe on your device—the website never sees it [3]. The website only gets the public part, which is like a mailbox that proves your private key opened it [3].
// sources
Oct 13, 2023 ... Passkeys work by using cryptographic key pairs instead of passwords, which makes them way more secure. When you log in from different devices, ...
The passkey registration process typically occurs after the user signs in to the online service account with an existing authentication method.
Feb 27, 2026 ... A Passkey is created (conceptually) by creating those two keys, then sending the public key to the server and storing the private key with some ...
Oct 10, 2023 ... The passkey makes signing in more secure. It works using public key cryptography and proof that you own the credential is only shown to your ...
May 7, 2026 ... Passkeys are a way to log in without a password. They use your phone or another supported device to prove that you are who you say you are before letting you ...
Video by Cybernews
Video by Microsoft Security
Video by All Things Secured
