Think of it like SSH authorized keys but automated for the web. Instead of storing the keys in a file; it stores them in a hardware security module (yubikey, or TPM).

Registration generates an asymmetric key pair between your passkey, and the website. Login is the usual challenge/response process. The biggest step forward is phishing resistance. A fake login page can relay a TOTP code, but not the passkey challenge/response.

100% had said something to the tune of this months ago in another thread on passkeys

> Passkeys need a marketing campaign and UX overhaul. I’m a technical guy, but I really don’t understand what the fuck is going on when I use a passkey. All I know is one day it appeared as an option and it let me login to things. I don’t really understand where it lives, what device it’s tied to, how scanning a QR code on Google Chrome on my phone magically logs me in, etc etc.

The user was not educated on this. Hacker News is the top 1% of computer power users. You gotta understand to someone’s grandma or mom or brother who works in real estate none of this makes any sense nor will they educate themselves on what it is.

https://news.ycombinator.com/item?id=46301585#46303892

You can use both hardware bound passkeys (where you may not even be able to read the secret so you probably would want to add multiple device passkeys to a site)

or shared passkeys (where the private key can be synced through something like a cloud service across your devices, see Bitwarden, iCloud)