Also known as: FIDO2 · WebAuthn · passwordless
A passkey is a phishing-resistant credential based on public-key cryptography that replaces passwords: the private key never leaves the user's device, and authentication is cryptographically bound to the legitimate site's domain.
Because the browser will only present a passkey to the exact origin it was registered with, a convincing lookalike domain simply receives nothing usable. This structurally eliminates credential phishing rather than merely making it harder, which is the fundamental advantage over one-time codes.
Passkeys also remove the shared-secret problem entirely: there is no password on the server to breach, so a database compromise does not yield reusable credentials. The main friction has been account recovery and cross-device synchronisation, which platform vendors address with varying degrees of lock-in.
Multi-Factor Authentication
Multi-factor authentication (MFA) requires two or more independent categories of evidence to verify identity — typically something you know, something you have, and something you are — so that a stolen password alone is insufficient to gain access.
Phishing
Phishing is a social-engineering attack in which an adversary impersonates a trusted party — typically via email, SMS, or a cloned website — to trick a victim into revealing credentials, authorising a payment, or installing malware.
Credential Stuffing
Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.
Zero Trust
Zero trust is a security architecture that removes implicit trust based on network location, requiring every request to be authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the corporate network.