A shared secret is a liability on both ends
A password has to be created, remembered, transmitted, and stored securely by both the user and the service — and it fails if either side handles it carelessly. Users reuse passwords across services because remembering dozens of unique ones is genuinely hard; services that store passwords, even hashed, hold something worth attacking at scale, because a breach anywhere exposes every account that reused the same one.
Passkey-based authentication removes the shared secret from the picture entirely. A key pair is generated on the user's device; the private half never leaves it, and the service stores only the public half, which is useless to an attacker without the corresponding private key. There's no password to phish, reuse, or leak from a server breach, because there's no password.
What this changes about phishing specifically
A phished password works against any site the attacker sets up to look convincing, because the user is the one deciding, correctly or not, where to type it. A passkey-based credential is tied cryptographically to the exact origin it was registered for, so a lookalike site simply can't request a valid response from the browser the way a fake login form can request a typed password — the protection is structural, not dependent on the user noticing anything.
This doesn't eliminate every account-security risk — a compromised device holding the private key is still a real threat — but it removes the single most common failure mode in credential-based authentication almost entirely, rather than mitigating it with better user habits that are hard to enforce at scale.