'%3e%3c/ellipse%3e%3cpath%20d='M20.5%2023.5%20L3.4%2045.6%20L23%2031.8%20Z'%20fill='%23B4EE3A'%20stroke='%23B4EE3A'%20stroke-width='3'%20stroke-linejoin='round'%20stroke-linecap='round'%3e%3c/path%3e%3cpath%20d='M47%2020.5%20Q42%2033%2030.5%2036.5'%20stroke='%23FFFFFF'%20stroke-opacity='0.35'%20stroke-width='2.4'%20fill='none'%20stroke-linecap='round'%3e%3c/path%3e%3ccircle%20cx='30.2'%20cy='20.2'%20r='4.4'%20fill='%23FFFFFF'%3e%3c/circle%3e%3ccircle%20cx='28.9'%20cy='20.4'%20r='2.15'%20fill='%23101116'%3e%3c/circle%3e%3ccircle%20cx='27.9'%20cy='19.1'%20r='0.85'%20fill='%23FFFFFF'%3e%3c/circle%3e%3c/svg%3e)
Why this matters
Passwords leak. Passkeys do not type.
0% complete · 8 min · Introductory · Written lesson · Free under CC-BY-4.0
CISA's phishing-resistant MFA fact sheet is explicit: the only widely available phishing-resistant method is FIDO/WebAuthn. Passkeys are that protocol on a phone, laptop, or security key.
A passkey is a key pair. The private key stays on your device or in your manager. The site gets a signature bound to its real origin. A look-alike login page cannot collect it.
Your progress stays in this browser. It is never sent to us. No account, no email, no analytics on these pages.
Reviewed and signed off by
Peer review pending - no reviewer has been recorded for this module yet.