There's 2 main reasons they differ from "something you know": 1) A passkey isn't phishable, as it's a digital signature that wraps the origin domain that is re

There's 2 main reasons they differ from "something you know": 1) A passkey isn't phishable, as it's a digital signature that wraps the origin domain that is requesting the passkey. That means a phishing site can't "request" a valid passkey for another site, and replay it to gain access. This helps "normal users" who could be tricked into entering the MS/Google login on a credible-looking SSO portal, and approving the MFA request - a passkey will stop this. 2) You authenticate via a non-replayable signature. If the site's backend database is dumped, nothing is learned - nobody gets even a hash of a password. The stored data is guaranteed to be unique to that site (different public key for every account you make, even on the same site). You can't use it against other sites. If the site checks logs and can be confident the database wasn't tampered with, then after a compromise, they can continue to rely on webauthn logins - just because you saw someone's public key and encrypted offloaded private key doesn't help you log in as them. In contrast, with stored password hashes, users with weak or re-used passwords are at particular risk in this case, and you likely want to force them in through the reset password route, rather than let the attacker used a brute-forced or otherwise leaked password.