What the !#@% is a Passkey?

This is part 1 of our series on passkeys. Part 2, on privacy, is here.

A new login technique is becoming available in 2023: the passkey. The passkey promises to solve phishing and prevent password reuse. But lots of smart and security-oriented folks are confused about what exactly a passkey is. There’s a good reason for that. A passkey is in some sense one of two (or three) different things, depending on how it’s stored.

First off: is a passkey one of those little plastic things you stick in your USB port for two-factor authentication? No, that’s a