# What is a passkey?

> A cryptographic key pair stored on your device that replaces a password and cannot be phished or reused.

Last reviewed: 2026-09-01

## Passkey

Category: Authentication

Also called: FIDO2 credential, WebAuthn credential

Canonical page: https://moolkey.com/glossary/passkey

A passkey replaces a password with a public and private key pair. The private key never leaves your device and is unlocked by your fingerprint, face, or device PIN; the site only ever stores the public key. Because nothing secret is transmitted, passkeys cannot be phished, reused, or stolen in a database breach.

### How signing in works

The site sends a random challenge. Your device signs it with the private key after you authenticate locally, and returns the signature. The site verifies it against the stored public key. No shared secret ever crosses the network, which removes the entire class of attacks based on capturing one.

### Where passkeys fall short today

Coverage is incomplete. Many sites still require a password as a fallback, and that fallback remains the weakest link. Syncing across ecosystems is improving but can still be awkward, and recovery generally routes through your platform account, which becomes a new point of concentration.

### What people often get wrong

Claim: "Passkeys mean I no longer need a password manager."

Correction: Eventually, perhaps. Today almost every site that offers passkeys keeps password login enabled as a fallback, so the password still has to be strong and unique.

Further reading: [Passkeys versus password managers](https://moolkey.com/blog/passkeys-vs-password-managers)

### Sources

- [FIDO Alliance: Passkeys](https://fidoalliance.org/passkeys/): How device-held key pairs replace shared passwords and resist phishing.
- [W3C: Web Authentication: Level 3](https://www.w3.org/TR/webauthn-3/): The web standard behind passkeys and FIDO2 security keys.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [OWASP: Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html): A comparison of authentication factors, recovery paths, and common attack routes.