What is a Passkey?
Passkeys, told as a story about a ring that recognizes its own gate.
Passwords must be remembered, and they keep leaking.Written down, reused, overheard.
A person types the code — so they'll type it into a fake gate (a phishing site) too.The code itself can't tell a real gate from a fake one. It's the last scene of the gatekeeper story.
A passkey is a ring that knows its gate.The castle's name is engraved inside. Ring and gate check each other; I just touch it.
At a fake gate, the ring stays dark.Wrong castle name. There's no code to read out — nothing to steal.
Losing the ring is a problem.The phone is the ring. So it's copied into a key locker (your Google or Apple account), or you keep a spare. And some castles don't take rings yet.
A passkey = a ring that knows its gate, with nothing to remember. At a fake gate it does nothing at all.
The FIDO2 / WebAuthn standard. The ring's secret (private key) never goes to the castle; the castle holds only a photo (public key). So even a robbed castle can't copy my ring.
When grown-ups say it
- Private key
- The secret in the ring. Made inside my device and never leaves it.
- Public key
- The photo of the ring. Kept by the castle. Stealing it doesn't let you forge the ring.
- WebAuthn · FIDO2
- How ring and gate talk. The standard that makes browsers and castles speak the same language.
- Biometrics · PIN
- The finger that wakes the ring. Face or fingerprint stays on the device; the castle never sees it. → the gatekeeper story
- Synced passkey
- The locker copy. iCloud Keychain, Google Password Manager. The ring follows you to a new phone.
- Security key
- A ring you plug in. A small stick like a YubiKey. Can't be copied, so it's the sturdiest.
- Phishing-resistant
- Dark at a fake gate. Because the castle's name is engraved in the ring. → T1566 in the encyclopedia