A cryptographic key is a mathematical value used by an authentication system to prove identity, encrypt data, or create a digital signature. In most login systems, the private key is kept secret on the device or in protected hardware, while the public part can be shared. The user may unlock the key with a PIN, password, or biometric check, but those factors do not replace the key itself; they only authorize its use.
Keys matter because compromising them can let an attacker impersonate a user without guessing a password. In passwordless sign-in, the private key may be the real credential behind the scenes, so defenders must protect the endpoint, lock sessions quickly, and store keys in secure hardware such as a trusted platform module or secure enclave. If compromise is suspected, organizations should revoke sessions, invalidate tokens, and rotate credentials to stop reuse of the stolen trust.