This login page is fake... and it's perfect. Your password would walk right in.

So how do you log in, when the site never gets a secret?

One analogy makes it click: a signet ring.

What passkeys replace

First, what passkeys replace: the password. Whoever has your password logs in as you, from anywhere.

The ring and the impression

Picture a signet ring and its wax impression. A passkey works the same way, with a pair of keys.

Passkey Signet ring

private key the ring: it stays on your devices, never with the site

public key the impression: that's all the site stores

signature the stamp

challenge a blank card with a random number

site address (RP ID) the engraving on the ring

Where the analogy breaks: a real ring can be copied from wax.

Creating a passkey

The site gets the impression, the public key, and that's ALL it stores.

So if that server gets breached, the attacker gets a pile of impressions.

But if the site never gets anything secret...…