Passkeys

Removing the shared secret.

The idea

Your device holds a private key and the site holds the public one. Signing in proves possession without sending anything reusable, so there is no password to phish or leak.

Unlocked by your fingerprint, face or device PIN.
Synced across devices by your platform or password manager.

Where they stand

Support is broad and growing. Most sites keep a password as a fallback, which limits the benefit until that fallback is removed.