Passkeys aren't scary - passwords are. Let's bust some security myths

Passkeys beat passwords.

Not everyone agrees. But I’ve found that some dissent is rooted in a lack of understanding how passkeys work.

I don’t blame the skeptics. Passkeys are simple to use, but their technical nuances can be a headache to understand. So let’s get into the details.

What a passkey is

Passkeys are the informal name for the WebAuthn standard for authentication. It relies on asymmetrical encryption (aka public-key cryptography). When you create a passkey, a public-private key pair is generated. The website gets the public key. You own the private key, which remains secret. It facilitates the authentication process, but it’s never directly shared for the verification process to complete. Nor can it be extrapolated from the public key.

Your private key is tied to wherever y