Let me have a go...
Passkeys use public key cryptography, in that you have private and public keys. This means you can sign messages where the other side can check the signature, but couldn't forge your signature themselves.
As a rough analogy, think about writing a cheque. A cheque says: "Dear Barclays, please pay Bill Smith ten pounds. Yours J. Jones"
and it's based on something you have (a chequebook - nobody should be able to forge it) and a signature (something that another person can't reproduce). If somebody steals one piece they can't reproduce the other piece - if someone steals your blank cheques they can't forge your signature, and if they copy your signature they don't have your chequebook to make valid cheques. (in theory, anyway)
With public key crypto, 'signing' means using your private key to provide checkable proof that you are who you say you are, in a way that the recipient can check but can't forge.
Doing that with passkeys has two steps:
- Unlock the passkey with something (fingerprint, PIN, passphrase, face, etc)
- Use the unlocked passkey to sign a challenge from the website.
So what happens is you set up a passkey with a certain website. To login, your computer then prompts for (let's say) a PIN. This PIN is only used to unlock the passkey stored on your machine - it's not sent to the other end. If successfully unlocked, you can sign the challenge with your passkey in a way that the other end can safely check, and if the checks pass you're logged in.
The other thing that passkeys do is they are specific to a particular website. You can't ask Lloyds to pay a cheque that's drawn on a Barclays account. For passkeys, the cryptography will fail if used on the wrong website, and a fake website can't use that failed login to try to login to the real website so phishing is stopped. This also prevents password sharing between different websites (even if you use the same PIN, the websites don't see it).
Therefore what you're doing is storing perhaps one key pair for every website on your computer, rather than a bit of paper with a password for that website. Each key pair has a way to 'unlock' it on your machine before you can use it. Sometimes this 'unlock' mechanism involves a second device
- eg most desktops don't have fingerprint readers, but there's a way for the desktop browser to talk to the fingerprint reader on your phone to unlock. This stuff is optional - you can just use a PIN to lock your keys if you don't mind the reduced security.
The next problem comes when you have multiple machines - perhaps a desktop, a laptop, a phone, a tablet. If you login on your desktop you'd quite like to be able to login on your tablet as well. This means there are various methods to sync passkeys between different devices. To begin with this was heavily cloud-based: if you have passkeys in your Apple Keychain then you can use them on your Mac and on your iPhone. Microsoft and Google have similar systems for their 'ecosystems'.
This caused some lockin: you couldn't extract the key from your iPhone to use on your Android. Sometimes websites would let you set up multiple passkeys for your account (one for login from iPhone, one for Android), but not always. But more recently sync protocols have developed that allow syncing between different platforms (I'm not up to date where that stands currently). Another way to do it is to use a password manager that can be installed across your devices of different brands, that keeps hold of your passkeys and permits syncing between the devices.
Finally, passkeys work like better passwords. But not all websites are using them that way. For example, some are removing the credential reset procedures (sending an email with a link to reset your password) 'because it makes it more secure and you should backup your passkeys', but that puts the onus on the user to do that. If you lose your passkeys you may find that some websites lock you out because they don't have a way to verify you. In the case of Barclays there would always be a 'visit a branch with your passport' kind of fallback if you lose your login details, but some Big Tech companies don't want to implement that kind of flow (physical identity checking costs money) - no passkey and no recovery codes means you are locked out of your account forever. This is something to watch out for when enabling passkeys.
Theo