You've probably been offered a passkey by now—a prompt asking to use your face, fingerprint, or device PIN to sign in instead of typing a password. It's worth accepting, and it's worth understanding what you accepted.
What a Passkey Is
A passkey is a pair of matched keys. One half stays on your device and never leaves it; the other half is handed to the site when you set it up.
When you sign in, the site sends a challenge, your device answers it using the half it kept, and the site checks that the answer fits. The face or fingerprint scan isn't sent anywhere—it just unlocks your device so it will answer. There's no secret to type, so there's nothing for you to remember and nothing for a site to leak.
Why Phishing Doesn't Work On It
A password can be typed into the wrong place. That's the entire mechanism behind phishing: get you onto a convincing lookalike page and you hand over the secret yourself.
A passkey is bound to the real site's domain. On a lookalike, your device simply has no key to offer—not because you were paying attention, but because the match fails. That's the meaningful upgrade over even good multi-factor setups, where a code you read off a screen can still be relayed to an attacker. We covered that trade-off in What Multi-Factor Authentication Actually Buys You; passkeys close the gap that codes leave open.
Realistic Expectations
The transition is uneven and will be for a while. Plenty of sites don't offer passkeys at all, some offer them but still let a password sign you in—which means the password is still the weak point—and account recovery often falls back to email or a phone number.
So passkeys don't retire your password manager. They sit alongside it, and everything without passkey support still needs a long, unique password. If you haven't set a manager up, start with Password Managers Are Worth It; most of them can hold passkeys too, which solves the "what if I lose the phone" question better than a single device can.
Turn passkeys on where they're offered, especially email and banking. Then keep doing the boring password work everywhere else, because that's most of the web for now.