Sign-in prompts increasingly ask for a fingerprint or a face rather than a password. The change is not about convenience, and it removes the two failures that make passwords unfixable.
A password is a shared secret held in two places
Password authentication requires the user to know a string and the service to hold something derived from it. Both copies must be defended.
Services hash the stored version, which helps, but the fundamental problem remains that the correct answer is transmitted to the server every time someone logs in.
Any point where a secret travels or rests is a point where it can be intercepted or stolen in bulk.
Public key cryptography splits the pair
A passkey is a key pair generated on the user's device. The private half never leaves it, and the public half is handed to the service at registration.
To sign in, the service sends a challenge. The device signs it with the private key, and the service verifies the signature against the public key it already holds.
Nothing secret crosses the network, and nothing secret is stored on the server. A stolen database of public keys is of no use to an attacker.
Phishing fails because the key is bound to the domain
A convincing fake login page defeats a password because a person cannot reliably distinguish the real domain from a lookalike.
A passkey is registered against a specific origin, and the browser or operating system enforces that binding. Presented with a fraudulent domain, the device simply does not have a matching key to offer.
The user's judgement is removed from the decision, which is the point.
The private key is protected by hardware
On most modern devices the key sits in a dedicated secure element, isolated from the main operating system.
The fingerprint or face scan does not authenticate to the website. It unlocks local use of the key, and the biometric data itself never leaves the device.
Synchronisation across a user's devices happens through an encrypted keychain provided by the platform, so a lost phone does not mean a lost account.
Recovery remains the unsolved part
Losing every enrolled device raises a question passwords answered badly but did answer, which is how to prove identity from nothing.
Most services fall back to email links, recovery codes or identity checks, and that fallback is now the weakest link in the chain. Closing it is where the remaining work sits.