# What is Phishing?

> Tricking someone into entering credentials on a fake site or handing them over to an impostor.

Last reviewed: 2026-09-01

## Phishing

Category: Attacks

Canonical page: https://moolkey.com/glossary/phishing

Phishing tricks you into giving your credentials to an attacker, usually through a convincing copy of a login page reached from an email or message. It bypasses password strength entirely. A 32-character random password typed into a fake site is exposed as quickly as a weak one.

### Why strong passwords do not help

Phishing does not guess your password; it asks you for it. This is why the security advice shifts here: check the domain before typing, use a password manager that refuses to autofill on the wrong domain, and prefer passkeys or hardware keys, which cryptographically verify the site's identity for you.

### The autofill defence

A password manager's autofill is a quiet anti-phishing feature. It matches on the exact domain, so if it declines to fill a page that looks familiar, that hesitation is a signal worth trusting more than your own eyes.

### Sources

- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [W3C: Web Authentication: Level 3](https://www.w3.org/TR/webauthn-3/): The web standard behind passkeys and FIDO2 security keys.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.