Phishing-resistant credentials are login methods that are much harder to steal through fake websites, prompts, or sign-in pages. The best-known examples use cryptographic proof tied to the real service, such as FIDO2 security keys and passkeys. Unlike passwords or one-time codes, they do not rely on the user typing a secret into whatever page appears in the browser.
This matters because many attacks target the sign-in flow itself. In a network-path attack, DNS tampering or a captive portal can send a user toward an attacker-controlled page that looks legitimate enough to capture ordinary credentials. Phishing-resistant authentication blocks that tactic by making the browser and device verify the expected site before releasing the credential. Defenders use it to protect cloud accounts, remote access, and privileged logins, especially for travelers and high-risk users who may connect through untrusted Wi-Fi.