What a passkey is

A key pair the phone or laptop creates and keeps behind its own lock screen. Signing in means the device signs a one-time challenge with the private half, which never leaves it and never crosses the network. There is no shared secret to steal from your database, nothing to reuse on another site, and nothing for a fake login page to capture: the browser will only offer a passkey to the domain it was created for. Passwords keep working alongside them; a passkey is an extra way in, not a replacement you have to force on anyone.