Passkey

A passkey is a cryptographic credential, a public/private key pair, that replaces a password. The private key never leaves the user's device or password manager; signing in means proving possession of it, unlocked by the device's biometric or PIN. Because the credential is bound to the website's origin, a convincing fake site receives nothing it can replay.

Passkeys solve the credential problem: they cannot be phished, reused, or leaked in a database breach. They deliberately do not answer whether the right human controls the device holding them right now, which is why passkeys pair naturally with live device and carrier state.

The question passkeys deliberately leave open is worth stating plainly, because it is where deployments get surprised. A passkey proves that the device holding the private key participated and that the origin was genuine. It does not prove that the enrolled human is the one holding the device now, and it says nothing about the state of any other channel attached to the account. Those are separate facts requiring separate evidence.

Recovery is where most passkey deployments leak. An account that can be recovered with an emailed link or an SMS OTP has the security of that weaker path, because an attacker will use it rather than attacking the passkey. Raising the credential's strength without raising the recovery floor moves the attack rather than stopping it, which is the substance of account recovery fraud.

Synchronization is the other property to decide deliberately. A passkey synced through a platform account is available on the user's other devices and is as strong as that platform account; a device-bound passkey cannot be copied but is lost with the hardware. Both are passkeys, they carry different assumptions about what an attacker must compromise, and only the second is device binding in the strict sense.