Passkeys are one of the biggest practical improvements authentication has seen in years. They significantly reduce phishing and credential theft, but they do not make authentication magically secure. This piece is a plain look at how passkeys work, what they improve, and where their real weaknesses still are.