Syllabus Lesson 85 of 156 · Encryption you can explain
Encryption you can explain

Passkeys and passwords

Why it matters Phishing, a fake page that tricks you into typing your password, is one of the most common ways accounts are taken over. Passkeys are designed so that even a perfect fake page gets nothing useful. Knowing why helps you decide where to switch, and how to offer them on sites you build.

A password is like a secret phrase you whisper to a doorman. Anyone who overhears it, or any fake doorman who asks, can use it. A passkey is more like a key that only fits one door, and that your keyring refuses to even hand to the wrong door.

Phishing: tricking someone into giving away a login or other secret, usually with a message and a fake site that looks real, such as shopa-login.example pretending to be shopa.example.

Passkey: a login made from a public key pair, created for one website. The private key stays in your device or password manager; the site stores only the public key.

Why passwords are fragile

  • You can be fooled. A fake page asks, you type, and the attacker has it.
  • They are reused. If one site leaks its password list, attackers try the same email and password on other sites.
  • The site holds a copy. Well-built sites store only a slow hash (Leg 3 covered this), but the secret you type still reaches their server every time.

How a passkey login works

  1. When you create a passkey, your device makes a new key pair just for that site and sends the site the public key.
  2. When you log in, the site sends a random challenge, a fresh number used once.
  3. Your device asks you to unlock it (fingerprint, face or PIN), then signs the challenge with the private key. That is lesson 84's signature, used for login.
  4. The site checks the signature with the stored public key. Match means it is you.

Your fingerprint or face never goes to the site. It only unlocks the key on your own device.

Why passkeys resist phishing

Every passkey is tied to the site's domain. Your browser itself checks which domain is asking, and will only use the shopa.example passkey on shopa.example. On shopa-login.example there is simply no passkey to offer, however convincing the page looks. You do not have to spot the fake; the browser does.

A stolen database is also less useful: it holds public keys, which cannot be used to log in. And each site gets its own key pair, so there is nothing to reuse elsewhere.

The honest downsides

  • Losing devices. Passkeys synced through a password manager survive a lost phone; a passkey on a single hardware key does not. Keep a second way in.
  • Recovery is the weak spot. If a site lets you reset by email, an attacker who gets your email can still get in. A passkey is only as strong as the account's recovery path.
  • Moving between ecosystems can be awkward, though password managers are adding ways to move passkeys between them.

All major browsers and operating systems support passkeys (checked October 2026). For sites you build, this is the WebAuthn standard, offered through the browser's built-in navigator.credentials functions.

A common misconception: "passkeys send my fingerprint to the website". They do not. The biometric check happens on your device and only unlocks the private key there.

Try it Open your password manager or your device's password settings and look for a passkeys section. Then, on one account you use often, look in its security settings for "create a passkey". Check that you still have a recovery option before you rely on it.

Recap

  • A passkey is a key pair per site: the private key stays with you, the site keeps the public key.
  • Login is a signature over a fresh challenge, unlocked by your face, fingerprint or PIN on your device.
  • The browser only offers a passkey to the domain it was made for, so fake sites get nothing.
  • Recovery paths and lost devices are the weak spots; keep a second way in.

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Back