Passkeys are phishing-resistant login credentials that replace reusable passwords. Instead of typing a secret that can be copied, a device or authenticator stores a private key and proves possession of it during sign-in, usually with biometrics, a PIN, or a device unlock. The server keeps only a public key, so there is no password to steal or reuse across sites.
They matter because many attacks start with stolen credentials. In credential-stuffing campaigns, attackers test leaked username and password pairs at scale, hoping users reused the same password elsewhere. Passkeys break that pattern: a captured credential cannot be replayed on another service, and phishing pages cannot easily trick a user into handing over the secret. For defenders, passkeys are a strong step-up or replacement for passwords, especially on consumer apps that need to reduce account takeover risk.