[kodt]

The difference is you can't just copy and paste the private key into a phishing website. The login process validates your private key and logs you in.

Also since the service does not store your private key, it is more resistant to data-breaches as that is one less potential breach source.

[RHSeeger]

But most password programs do this too, if you install the plugin (which you pretty much need if you want those same programs to do the passkey thing, anyways)