So how do they work?  Passkeys are on the web authentification, or Web Authn, standard. It uses a cryptographic principle called 'public-key cryptography to secure your accounts.  It's the same idea that's used for end-to-end encryption in iMessage, Signal, and other secure communications apps. Instead of creating a password for an account, your device will create a unique pair of mathmatically related keys: a public key and a private key. The public key is stored on the server (because, as the name suggests, it's not a secret) and will allow the website or app to verify your account-as long as you have the matching private key.  The trick is that because of how the math works, the private key never needs to get shared with the server. Your device can do all the authentication without ever revealing it. It's neat tech,and it has serious security implications.                  Although pass keys might sound complicated (and the underlying cryptography is indeed complex), in practice, they will make signing up for new accounts, even simpler. You will just use Touch ID or FACE ID, and your iphone, iPad or Mac will do the rest. You don't have to come up with a long password, and in a few $s and &s, and then try to remember it. You won't even see your public or private keys.    It's all done in the background, which takes the squishy, unreliable human element out of things. Also, passkeys can't be phished. Your public key for any given site isn't privilaged information. All that matters is the private key, which never leaves your device. A fake website designed to impersonate your bank, Ebay, or some other account can't trick you into giving it up.  It can set up a login prompt, but it won't do anything.                Apple's implementation of passkeys-at least in the supporting docs and WWDC talk-sounds solid. They will be synced between your devices using iCloud Keychain (which is end-to-end encrypted itself). Even Apple won't have access to your private keys.  The system has been designed so that your logins are safe, even if your Apple ID is compromised, you lose all your devices, or a rogue Apple employee tries to hack the iCloud keychain servers. It requires you to use two-factor authentication with your Apple ID, which makes it much harder for an attacker, even one with your iCloud password, to set things up on a new device. There's also a system called 'iCloud Keychain Escrow' - that handles restoring your passwords if you lose your devices. It's resistant to brute force attacks even by Apple.                                                                         While we're still waiting to see how Microsoft, Google, and the other big tech companies roll out passkeys, they have all pledged to make them interoperable across as many different devices as posible. We got a hint of that in the WWDC announcement when Adler demonstrated using an iphone to log into a website by scanning a QR code. This would allow you to do things like check your email on a friends computer or print something in a hotel without a password.     In short, this looks to be as secure a system as can reasonably be designed.  There are always going to be attack vectors, and dedicated hackers targeting specific individuals may find and use them, but for regular people this system should solve three of the biggest problems:  weak passwords, leaked passwords, and phishing.