One key difference is that it's not anything like a password. With a password, you send your password to the server and hope it's not intercepted or stored in

One key difference is that it's not anything like a password. With a password, you send your password to the server and hope it's not intercepted or stored in plain text. Passkeys are more equivalent to the server sending you some random data and asking you to sign that data plus the server url with your private key. Then the server can check it against the public key it has to verify you possess the correct private key. It's both phishing and replay resistant.