How Passkeys Work - Computerphile

0:00 – 3:40

Why passwords keep failing, and the simple idea behind passkeys

The video opens with a familiar little moment of confusion: a website offers to "add a passkey," and even a technically curious user admits, "I have not got a clue what that is." That uncertainty becomes the hook for the whole discussion, because passkeys are already being pushed into everyday login flows before most people understand what problem they are supposed to solve. The speaker starts by narrowing the frame. This is not a full passwords primer, but a look at the problems that still exist even now: people pick weak passwords, reuse them across sites, and get caught by phishing. The danger of reuse is concrete and old-fashioned. If one website is breached, that same password may unlock other accounts too. Phishing is even trickier because it preys on ordinary human behavior. You are busy, something asks for your password, and you type it. Even people who think they are careful are not guaranteed to resist every time. Two-factor authentication helped, but it brought its own mess, including random approval prompts on your phone that people may click without understanding. From there, the explanation pivots into the machinery underneath passkeys: public key cryptography. Instead of one shared secret, there are two keys. The public key can be shared openly, while the private key stays with you. The important point is not encryption here, but digital signatures. A website can send a token, your private key signs it, and the website checks that signature with the public key. If it verifies, the site knows the signature came from whoever holds the private key. That leads to the core mental model of the whole video. A passkey login is basically the website saying, "Prove it," by sending a fresh challenge. Your device signs that challenge, and the website verifies it. The speaker is careful to say this is only the intuitive version, because the real system has more moving parts. Still, that one shift matters: you are no longer typing a reusable secret into a form. You are proving possession of a private key without revealing it.