You open a sign-in page and your iPhone offers a passkey. There is no password to type, but it is reasonable to pause: where is the credential stored, and what happens if you lose your phone?
A passkey replaces the password used for that sign-in with a cryptographic credential. It can reduce typing and protect against a common phishing trick: persuading you to enter a reusable secret on a fake sign-in page. It still needs a supported service, a suitable device and a recovery plan. Apple: About the security of passkeys, Apple Developer: Supporting passkeys, FIDO Alliance: Passkeys—The journey to prevent phishing, part 2
Your face is not the passkey
When you create a passkey, your device generates a pair of cryptographic keys for that account. The service stores the public key. Your passkey provider protects the private key, which proves you can sign in without sending that key to the service. A stolen public-key record does not give an attacker the private key. Apple: About the security of passkeys
Face ID, Touch ID or a local passcode authorizes use of the credential. They are not the credential itself. The website does not receive your face or fingerprint through WebAuthn, the web standard behind this process. On iPhone, Apple's iOS 26 guide documents device-passcode sign-in when Face ID or Touch ID is not set up. W3C Web Authentication Level 2, iPhone User Guide, iOS 26: use passkeys
The credential is bound to its service. A lookalike domain cannot simply ask your browser to use the real site's passkey. Apps also need the appropriate association with their service's domain. That is the basis of phishing resistance; it does not guarantee that your device, the service or every account-recovery route is secure. ,
