An attacker sends a convincing email, you click through to a pixel-perfect fake of your bank, and you WANT to log in there. With a passkey on your device, what most likely happens?

The browser finds no passkey for that domain, so there is nothing to approve or hand over

You approve with your fingerprint and the login succeeds, handing the attacker a reusable signature

The browser finds no passkey for that domain, so there is nothing to approve or hand over

🔑 Why a passkey can't be phished — even if you fall for the fake site

A password is a shared secret: you know it, the website stores a copy, and anyone who tricks you into typing it (or steals the server's database) can reuse it. Passkeys throw that model out. When you create a passkey, your device generates a key pair — a private key that never leaves your phone or laptop (often sealed in secure hardware), and a public key that the website stores. The public key is useless to a thief: it can verify a signature but can't produce one.

To log in, the site sends a random challenge. Your device signs it with the private key — after you approve with a fingerprint, face, or PIN — and returns the signature. The server checks it against your public key. Nothing reusable ever crosses the network, so a breached password database becomes worthless.

The quiet masterstroke is phishing resistance. Each passkey is cryptographically bound to the exact domain (its origin) it was created for. Your browser, not you, decides whether the passkey applies — and it will only offer the key to the real domain. Land on a look-alike like paypa1.com, and the browser simply finds no matching passkey. There is no secret to type, and nothing for the fake site to capture.

This is why passkeys (built on the FIDO2/WebAuthn standards) are considered a genuine upgrade over passwords plus one-time codes — those codes can still be relayed to a fake site in real time, but a signature bound to the wrong origin is simply invalid.