A passkey is a cryptographic key pair — one lives on your device, one lives on the website. To log in, your device proves it has the private key using Face ID or your fingerprint. No password is transmitted. Nothing to steal.
Phishing doesn't work on passkeys. There's no login page to fake. Even if attackers trick you onto a fake Apple site, your device simply refuses to authenticate — the domain doesn't match the key it stored.
They also replace 2FA automatically. The biometric check IS the second factor. You get passkey-level security with one Face ID scan instead of password + authenticator code.
Sites that support passkeys today: Apple, Google, Microsoft, GitHub, PayPal, Best Buy, Docusign, and dozens more. On any of these, go to Settings u2192 Security u2192 Passkeys and set one up. It takes 30 seconds. You'll never type that password again.
The catch: passkeys are tied to your device ecosystem (Apple Keychain, Google Password Manager). If you lose your phone without a recovery plan, you could get locked out. Always keep one backup option — a recovery code saved somewhere safe or a backup device enrolled.