A passkey is a sign-in credential that replaces a password. It is built on the FIDO2 standards (WebAuthn and CTAP) and uses public-private key cryptography: the passkey is stored on your phone, computer, or a hardware security key, and you approve a sign-in the same way you unlock that device, with a fingerprint, face scan, PIN, or pattern. There is nothing to type or remember, and your biometric data never leaves the device; the website only receives confirmation that the check succeeded.
According to the FIDO Alliance, which develops the standard, passkeys are always strong and resistant to phishing, unlike passwords. They come in two forms: synced passkeys, which a cloud service copies across your devices, and device-bound passkeys, which never leave a single device such as a security key.
Source: FIDO Alliance, “Passkeys”.
Image: YubiKey 5C NFC security key, photo by Daniel Aleksandersen, CC BY 4.0, via Wikimedia Commons.