The short version
How public-key cryptography, device-bound credentials and passkey synchronisation change account security. Between 2020 and 2026, this field moved from specialist territory into everyday products and infrastructure. That does not mean every claim is true or every product is mature. It means the technology is now worth understanding at system level.
The cryptographic idea
A passkey uses a public/private key pair. The private key stays under the control of the user's device or credential manager, while the service stores a public key. During login, the device signs a challenge instead of sending a reusable secret.
Why this changes phishing
A correctly implemented passkey is tied to the relying party's domain, making the classic 'type your password into a fake site' attack much harder. This is a major conceptual improvement over passwords because the secret is not something a user needs to remember or type.
The migration challenge
The hard part is not the cryptography. It is account recovery, device loss, legacy systems and user education. Organisations need a recovery process that is secure without becoming so difficult that users fall back to unsafe workarounds.
What people often misunderstand
A technology can be technically possible without being economical, reliable or widely available. Benchmark results also need context: hardware configuration, workload, network conditions and software versions can change the outcome dramatically. For readers, the safest habit is to separate capability from product maturity.
A practical decision framework
Start with the problem. Define the outcome, constraints, security requirements and total cost. Then compare technologies against those criteria. This avoids buying a feature simply because it is new and helps identify cases where an older, simpler solution is actually better.
What to watch next
The next phase is likely to be defined by convergence. AI is being embedded into software and devices; networks are becoming more programmable; physical machines are gaining sensors and autonomy; and security has to span all of it. The most important breakthroughs will be the ones that connect these layers reliably rather than isolated demonstrations.