An authenticator creates a public–private key pair scoped to a particular relying party, such as a website or application. The service stores the public key; the private key remains under the control of an authenticator or passkey provider and is used to sign a fresh challenge during authentication.
The user normally authorizes use of the passkey with the same local mechanism used to unlock a device or security key, such as a PIN or biometric. That biometric is processed locally rather than sent to the service. Because WebAuthn binds authentication to the relying party and origin, a correctly implemented passkey is resistant to conventional credential phishing and cannot be reused at a look-alike service.
Key points
Two deployment formsA synced passkey can be made available across devices through a passkey provider; a device-bound passkey remains on a particular authenticator.
No shared passwordA breached service database contains a public key rather than a reusable authentication secret.
User verificationPolicy can require the authenticator to verify the user locally, but assurance depends on the authenticator, configuration, and recovery model.
Lifecycle needsServices must support secure registration, additional authenticators, device loss, revocation, provider changes, and auditable recovery.
Important limitationPasskeys do not secure an already stolen session or compensate for weak account recovery, unsafe enrollment, compromised endpoints, or excessive authorization after sign-in.