A passkey is a sign-in credential built on the FIDO2 standards. Instead of typing a password, the user approves the login on a device with the same fingerprint, face scan or PIN used to unlock it. Passkeys can stay on one device or be synced across a user’s devices.

How it works

• When a passkey is created, the device generates a key pair. The public key is stored by the website; the private key stays with the user.
• At login, the site sends a challenge that the device signs with the private key. No shared secret travels over the network.
• Each passkey is bound to the domain it was created for, so a lookalike site cannot request or reuse it.
• Local unlock (biometric or PIN) proves the person holding the device is present.

Why it matters for dark web monitoring

Much of what circulates in criminal markets is reusable secrets: passwords, one-time codes captured by phishing kits, and lists built for credential stuffing. Passkeys remove the reusable password and resist phishing, so a leaked login list is far less useful against accounts protected this way. They do not remove every risk. Session cookies stolen by infostealer malware can still let an attacker into an account that is already signed in, which is why defenders keep watching stealer logs even after moving to passkeys.

Sources: FIDO Alliance: Passkeys, NCSC: Passkeys, what you need to know