[kats]

I was having trouble understanding what they are.

Summary: It's a password manager on your phone. You sign into your password manager with something easy like biometrics or a PIN. Then all the 'real' passwords for sites are autogenerated and those are what's sent to sites when you log in.

[upon_drumhead]

It's actually neater than that. It's a cryptographic public/private key that is generated uniquely per service. It removes any risk of a login credential being leaked from the sites, as they just have a public key, which is entirely useless to actually auth with.

[heavyset_go]

Passkeys have terrible branding, with passkeys being used to describe multiple things over time and depending on what you're reading.

[rawgabbit]

Passkeys are similar to Apple Pay. Instead of authorizing a financial transaction, you are authorizing a login.