Imagine a fake sign-in page that looks like your real email service. A passkey helps protect against that trick because the credential is tied to the real site or app.
A passkey is a sign-in credential for a specific website or app. When a service supports it, you can approve a sign-in with the PIN, biometric check or other unlock method used by your device.
Passkeys use a pair of cryptographic keys. The service registers the public key while the private key stays with your authenticator. This design binds the credential to the original service and makes it resistant to phishing.
Before you set up your first passkey
Check whether the service lets you add a second passkey or use another recovery method. On a shared computer, use a device or password manager you control rather than saving the credential to a shared profile.
After setup, sign out and try the passkey once while you still have your other sign-in method. This gives you a chance to confirm which device or password manager holds the credential before you need it in a hurry.