What is passkey?

A login credential stored on your phone, computer, or security key that signs a challenge from the site instead of sending a password.

Passkeys resist phishing because the credential is bound to the real domain and cannot be typed into a fake one. Where an exchange offers them, they are stronger than app codes. The technology is the FIDO2 and WebAuthn standards, published by the FIDO Alliance and the World Wide Web Consortium, and it is the same mechanism behind hardware security keys.

The property that matters is not convenience, though the convenience is real. It is that a passkey cannot be handed to an attacker by a person who has been fooled, which is the failure mode every other login method shares.

How it works

Registration creates a key pair on your device. The private key stays there, protected by the device's secure hardware and unlocked by a fingerprint, face, or device PIN. The public key goes to the site.

Signing in, the site sends a random challenge. Your device signs it with the private key and returns the signature. The site verifies it against the stored public key. Nothing reusable crosses the network, so there is no password to steal from a database and no code to intercept.

The anti-phishing property comes from domain binding. The browser includes the origin in what gets signed, and the device will only use a credential registered for that exact origin. A lookalike domain gets nothing, because the device simply does not offer the credential.

Compare that to the alternatives. A password can be typed into a fake site. A one-time code from an authenticator app can be read aloud to a caller or entered on a phishing page in real time. A code sent by text message can be redirected by a SIM swap. All three depend on the user correctly identifying the site. A passkey does not.

Passkeys can be device-bound or synced through a platform account, which trades some of the security for recovery. A synced passkey is as strong as the account syncing it.

Example

Illustrative phishing attempt. You receive a message about a withdrawal you did not make, with a link to a domain that differs from your exchange's by one character.

With an authenticator app, you would open the site, enter your password, and enter the six-digit code. The attacker relays both to the real site within the code's validity window and takes over the session. With a passkey, you reach the fake site and your device offers nothing, because no credential exists for that origin. There is no code to relay and no step where being convinced does any damage.

Why it matters when you buy

Account takeover, not market loss, is how most people lose funds held on an exchange. Enabling the strongest login method a venue offers, and withdrawal whitelisting alongside it, is the highest-value security step available to a buyer. Which methods each venue supports is recorded at the exchange directory, and the comparison of methods is at Two factor authentication crypto.

Related terms

• two factor authentication — the category passkeys improve on
• totp — the authenticator app alternative
• phishing — the attack passkeys defeat
• sim swap — why text message codes are weakest
• withdrawal whitelist — the control to pair with it
• secure element — where the private key lives

Questions

Is a passkey the same as a hardware security key?

They use the same standards. A hardware key is a separate physical device, while a passkey usually lives on a phone or computer you already have. Both resist phishing the same way.

What happens if I lose my phone?

It depends on whether the passkey syncs through your platform account. A synced passkey restores with the account. A device-bound one does not, which is why registering a second credential matters.

Should I use a passkey instead of an authenticator app?

Where an exchange supports it, yes. A passkey defeats the real-time phishing that defeats authenticator codes. Keeping a second method registered as a backup is still sensible.