How does passkey cryptography work?

Passkeys use something called public-key cryptography, a branch of mathematics that underpins all secure communication on the internet.

When you create a passkey, your device is creating whats called public and private "keys", which are very very large numbers.

The website stores the public key and knows which user account it is for, whilst your device stores the private key and knows which website its for.

When you log in, the website sends a numerical challenge which your device uses the private key to calculate a response for and sends it back to the website. The website is able to use the stored public key to prove the challenge could only have been responded to if your device has the right private key.