A longer secret can still be handed over
A fake login page can collect a password you type into it. Making the password longer does not stop that particular deception. NIST distinguishes phishing from guessing: the attacker persuades you to reveal the secret instead of working it out. [1]
- Password: type a reusable secret
- Passkey: use a site-bound credential
A passkey changes the exchange
Passkeys use a pair of cryptographic keys rather than a password you enter into a page. The website keeps the public key; the private key is needed to authenticate. Google’s developer guide explains that the public key alone cannot be used to derive the private one. [3]
Why a copied login page is different
FIDO’s standards overview describes passkeys as bound to the online service’s domain. Google explains that the browser or operating system checks the website or app identity before using the credential. A lookalike page does not become the registered service just by copying its appearance. That binding is the important difference from a secret you can type anywhere. [2] [3]
What it feels like to use one
The sign-in action may resemble unlocking your device with a PIN or biometric check. It does not mean your fingerprint is sent to the website: FIDO says biometric information used for authentication stays on the device. [1] [2]
Before changing your sign-in
Our suggested next step is to read the service’s own passkey and recovery instructions. Ask: where will this credential be available, and how will I get back in if my device is lost? The distinction explained here is useful for choosing questions; it is not a guarantee about every service, device or recovery route.
Go a little deeper
Optional reading · about 1 more minute
Does a passkey have to stay on one device?
Some passkey providers synchronize credentials. Google documents encrypted synchronization through supported password managers and signing in on a nearby computer using a phone. Those are implementation features to check with your provider, not a reason to assume every passkey follows the same recovery process. [3]
What should I take away?
Treat password guessing, fake login pages and losing access as separate questions. A method can address one problem without settling all three. That is our interpretation of the distinctions above, not a product ranking or a promise that an account cannot be compromised.
Original sources
Attributed synthesis, not original reporting. Examples labeled hypothetical or illustrative are explanatory. Reviewing a source does not independently validate its findings.
- NIST: How Do I Create a Good Password? ↗
Created April 28, 2025; updated August 20, 2025. Phishing, passkeys and MFA sections reopened September 12, 2026.
- FIDO Alliance: User Authentication Specifications Overview ↗
Standards-body overview of domain binding and local biometric information read September 12, 2026; no implementation audit.
- Google Developers: Passkeys ↗
Updated April 15, 2026. Public-key, identity-binding, device-unlock and synchronization explanations read September 12, 2026. Provider documentation, not independent testing.
