Inspired by Ludwig’s comment, here is my explanation what Passkeys are. Foremost Passkeys are a replacement for passwords. Passkeys are trying to solve the issue of passwords being stolen by attackers and reused to access resources. When a Passkey is generated, your device generates a public and private key pair. The public key you have generated, is stored on the server you are trying to authenticate against. The private key remains on our device. When you try to login to the server, the server sends a challenge to your device. Using your private key, the device generates a response. The server verifies your response using the public key it has stored for your account. If the verification is successful, you will be allowed to login.
As the private key for a given service or server is only stored on your device, there is no risk that the private key gets leaked when the server is compromissed. Neither is there is a risk that the password is leaked on your client device because there is no password you have to enter. This approach makes it impossible to phish a passkey.
Besides storing the passkeys on your device, e.g., your smartphone or laptop, you can use FIDO keys (#reklame) that support passkeys. When using these physical keys, you don’t need to rely on cloud sync services to use your passkeys across multiple devices. The Yubico Yubikeys support up to 25 passkeys, starting with firmware version 5.7 up to 100 passkeys. If you are planning to store a larger number of passkeys, you should consider this FIDO key from Token2. This key allows you to store up to 300 passkeys. Another option is the Titan Security key offered by Google. The Google key can store up to 250 passkeys. Should you go the physical FIDO key route, make sure to get two keys for backup purposes. Else you could potentially lockout yourself in case your FIDO key gets lost or damaged.
