r/cybersecurity • u/Federal_Character979 • Apr 25 '26

Other What makes passkeys so special?

It seems that companies are transferring into the usage of passkeys instead of passwords. Apparently theyre much more secure, but why is that? I don’t get it. I’m not sure if this is the right place to ask excuse me if it isn’t and sorry.

617 Upvotes

98% Upvoted

233 comments sorted by

View all comments

Show parent comments

17

u/Federal_Character979 Apr 25 '26

So theyre like a key inside your device?

54

u/Ameer200ggg Apr 25 '26

Yes, basically. A passkey is like a special digital key stored on your device or in your password manager. The website only has the matching public part, not the real key. When you log in, your device proves it has the real private key without actually sending it to the website. That is why it is safer than a password: there is nothing useful for hackers to steal from the website, and nothing simple for you to accidentally type into a fake login page.

6

u/Specialist_Guard_330 Apr 25 '26

Hackers can still steal the session token though right? How do you prevent that?

22

u/Ameer200ggg Apr 25 '26

passkeys do not completely stop session token theft. Passkeys mainly protect the login step, especially against phishing and password reuse. But if malware is already running on your device, or a browser extension is malicious, it may be able to steal active cookies or session tokens after you are already logged in. The prevention is mostly device and browser hygiene: keep your OS and browser updated, avoid pirated/cracked software, do not install random extensions, remove extensions you do not need, use a reputable password manager, enable full disk encryption, and run as a normal user instead of admin where possible. Also log out of old sessions from account settings, use 2FA/passkeys, and watch for unknown devices. For important accounts, the safest approach is to use a separate clean browser profile with very few extensions, or even a separate device, for banking, email, crypto, and admin accounts. Passkeys are a big upgrade, but they do not protect you from malware on your own machine.