Passkey
A sign-in that uses your device's screen lock (face, fingerprint or PIN) instead of a password, and only works on the real site.
A passkey replaces typing a password with the way you open your phone or computer: your face, fingerprint or PIN. Behind the scenes, your device holds a secret key made for one website or app, and proves it has the key without ever sending it.
What matters for scams is that a passkey is tied to the real site's address. On a lookalike page, however perfect the AI-made copy, your device has no passkey for it, so there's nothing to type and nothing to steal. The check moves from your eyes to software. Many accounts keep a password as a fallback, so a fake site may ask for that instead; on an account where you use a passkey, a request for your password is a warning sign.
For example
You sign in to your bank with your fingerprint; a phishing copy of the bank's site can't use your passkey, so it asks for your password instead. That request is the warning sign.
Put it to use
Where you'll meet passkey in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.