Definition
Passkeys, also known as FIDO passkeys, are a passwordless authentication method that uses public key cryptography to verify a user's identity. Instead of a memorized password, a passkey is a cryptographic key pair stored securely on a user's device, like a smartphone or computer. When logging into a service, the device uses the private key to cryptographically sign a challenge from the server, proving possession without transmitting any sensitive credentials. This significantly enhances security by eliminating phishing vulnerabilities and the risks associated with password reuse. For example, a user can log into their Google account using their fingerprint or face scan on their phone, which securely authenticates them without ever typing a password. Unlike multi-factor authentication which often requires a password plus another factor, passkeys replace the password entirely. You will encounter passkeys on exams like CompTIA Security+ and CySA+.