[
    {
        "role": "user",
        "content": "What%27s%20a%20passkey%3F"
    },
    {
        "role": "assistant",
        "content": "Here\u2019s a breakdown of what a **passkey** is, how it works, why it\u2019s more secure than passwords, and what it means for you:\n\n---\n\n## What Is a Passkey?\n\n- A passkey is a modern authentication credential based on the *FIDO2/WebAuthn* standards. ([fidoalliance.org](https://fidoalliance.org/passkeys/?utm_source=openai))  \n- It replaces traditional passwords by using a **cryptographic key pair**: one private key stored on your device and one public key stored on the service (website or app) you\u2019re logging into. ([fidoalliance.org](https://fidoalliance.org/passkeys/?utm_source=openai))  \n- To authenticate, instead of typing a password, you unlock your device (via fingerprint, facial recognition, PIN, or pattern), which lets the private key sign a challenge sent by the service. The service verifies it with your public key. ([techterms.com](https://techterms.com/definition/passkey?utm_source=openai))  \n\n---\n\n## Why Passkeys Are Better Than Passwords\n\n- **Phishing-resistant**: Since your private key never leaves your device and isn\u2019t shared, attackers can\u2019t steal it through fake login pages. ([ncsc.gov.uk](https://www.ncsc.gov.uk/passkeys?utm_source=openai))  \n- **No need to remember anything**: You don\u2019t have to come up with strong passwords or worry about reusing them. The device handles the heavy lifting. ([techtarget.com](https://www.techtarget.com/whatis/definition/passkey?utm_source=openai))  \n- **Greater resilience against breaches**: Even if a service\u2019s server is compromised, only public keys are exposed\u2014not private keys or passwords. ([techterms.com](https://techterms.com/definition/passkey?utm_source=openai))  \n- **Faster and simpler user experience**: Logging in can be as quick as unlocking your device. ([ncsc.gov.uk](https://www.ncsc.gov.uk/passkeys?utm_source=openai))  \n\n---\n\n## Key Features & Types of Passkeys\n\n- **Types**:\n  1. *Device-bound passkeys*: Stored only on the device where they were created. If you lose the device, access could be impacted. ([support.microsoft.com](https://support.microsoft.com/en-us/windows/security/identity-signin/what-are-passkeys-and-why-they-matter?utm_source=openai))  \n  2. *Synced passkeys*: Encrypted backups synced across your devices via a trusted cloud service. ([fidoalliance.org](https://fidoalliance.org/passkeys/?utm_source=openai))  \n\n- **What unlocks them**: Biometrics (fingerprint, Face ID), PINs, patterns\u2014basically, whatever you already use to unlock your device. ([techtarget.com](https://www.techtarget.com/whatis/definition/passkey?utm_source=openai))  \n\n- **The process**:\n  1. You create the passkey for a website/app.\n  2. The device generates the key pair.\n  3. Public key goes to the website; private key stays locked on your device.\n  4. To log in, the website sends a \u201cchallenge\u201d, the device signs it using the private key, and the server verifies using the public key. ([developer.mozilla.org](https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Passkeys?utm_source=openai))  \n\n---\n\n## How Passkeys Are Used Today\n\n- Many major platforms\u2014Apple, Google, Microsoft\u2014support passkeys. When a site or app offers it, you\u2019re prompted to set one up instead of a password. ([techtarget.com](https://www.techtarget.com/whatis/definition/passkey?utm_source=openai))  \n- They\u2019re increasingly becoming **passwordless by default** on business services and modern operating systems. For example: Microsoft is making passkeys the default authentication method for its Entra ID starting September 1, 2026. ([techradar.com](https://www.techradar.com/pro/microsoft-is-making-passkeys-the-default-authentication-process-for-businesses?utm_source=openai))  \n\n---\n\n## What You Should Know\n\n- **Device compatibility**: You\u2019ll need a device that supports passkeys (newer phones, tablets, computers) and a browser that\u2019s compatible. ([support.microsoft.com](https://support.microsoft.com/en-us/windows/security/identity-signin/what-are-passkeys-and-why-they-matter?utm_source=openai))  \n- **Backup & recovery**: For synced passkeys, ensure your cloud or trusted account backups are secure. For device-bound ones, having a spare passkey or device helps if you lose your primary device. ([support.microsoft.com](https://support.microsoft.com/en-us/windows/security/identity-signin/what-are-passkeys-and-why-they-matter?utm_source=openai))  \n- **Security assumptions**: Although passkeys are much safer than normal passwords, they rely on the security of your device and the biometric/PIN you use to unlock it. If your device is compromised, that does pose risk. ([ncsc.gov.uk](https://www.ncsc.gov.uk/passkeys?utm_source=openai))  \n\n---\n\nIf you want, I can walk you through how to set up passkeys on your device or check if your favorite websites support them."
    }
]