A FIDO2 passkey is a phishing-resistant login credential built on public-key cryptography. Instead of sending a reusable password, the user’s device or security key signs a login challenge for the correct website or app. The private key stays on the device, while the server keeps only the public key, so there is no password for attackers to steal and reuse.
In cyber security, passkeys matter because they break common phishing and adversary-in-the-middle attacks. A fake Microsoft 365 page can capture a password, but it cannot easily replay a FIDO2 signature to a different origin. Defenders use passkeys to harden cloud identity, reduce account-takeover risk, and limit the value of stolen credentials, especially when combined with Conditional Access and session controls.