Glossary
Passkey
A passkey replaces a password with a cryptographic key pair: the private key stays on the user's device and never leaves it, while the server holds only the corresponding public key, which is useless to an attacker on its own. Logging in means proving possession of the private key, not transmitting a shared secret the server has to store and protect.
This changes what a server breach actually exposes. A database of passwords, even hashed ones, is worth attacking at scale because a fraction will crack or have been reused elsewhere. A database of public keys is not — there's no secret in it to recover, because the secret half never left the user's device in the first place.