With a password, the service checks a secret you supply, usually against a stored password hash. A passkey instead lets your device prove that it holds a private cryptographic key. It answers a fresh challenge without sending that private key to the service.

This changes the sign-in attack: stealing the service’s public verification key does not provide a password to replay or a private key to sign with. Passkeys do not eliminate compromised devices, stolen sessions, dishonest requests or weaknesses in other account access routes.