Passkey

A passkey is a login credential based on a key pair rather than a shared secret: the private key stays on the user's device or in their synced keychain, and the site holds only the public half, so there is nothing stored on the server that an attacker can steal and reuse. Signing in means the device proves possession of the private key after a local check such as a fingerprint or PIN. Two properties matter for account safety. The credential is bound to the site's domain, so a lookalike page cannot elicit a usable response, which is what makes passkeys resistant to phishing in a way typed codes are not. And there is nothing to type, so nothing to capture from a screen, a message or a keystroke. What a passkey does not do is protect keys to funds: it secures an account on a platform, and where that account is at an exchange, the funds still sit with the exchange.