Passkeys as implemented are normally multi-factor. You need to both posses a device whose platform authenticator contains a key registered with the site, and al

Passkeys as implemented are normally multi-factor. You need to both posses a device whose platform authenticator contains a key registered with the site, and also enter either a PIN, or use biometrics. On mobile devices this is done via the same options available on the lock screen, while for Windows this is "Windows Hello". I'm not sure how MacOS works here, but presumably similar to iOS. As an alternative to using a platform authenticator a FIDO2 security token can be used over USB, bluetooth, or smart card NFC. It is up to the site to specify if user verification (i.e. a second factor) is required, or not. If required, the authenticator must verify the user, typically via biometrics or PIN, although a desktop OS may fall back to login password. The website may instead specify "preferred", which generally requires a second factor, but allows an authenticator to skip in in some circumstances (like if a classic password is the only verification option available, as opposed to a PIN or biometrics, since in that scenario requiring the user to type their computer login password every time is generally not a good user experience, and would be best reserved for extra sensitive scenarios).