Glossary
Passkey
A FIDO2 discoverable credential used to sign in without a password, either bound to one device or synced across devices by a platform account.
A passkey is a FIDO2/WebAuthn discoverable credential: the authenticator stores enough information to log the user in without typing a username, and user verification (PIN or biometric) replaces the password.
There are two families. Device-bound passkeys live in non-exportable storage on a single hardware key or device. Synced passkeys are copied between a user's devices by a platform or password manager with end-to-end encryption, so they survive the loss of a phone. Both are phishing-resistant; device-bound passkeys are preferred for privileged accounts because the private key can never be copied.