In plain English
A passkey lets you sign in without typing a password. Your device or a hardware key proves who you are, and because the credential is tied to the real website address, a fake login page cannot use it. Even a convincing phishing site gets nothing worth stealing.
Full definition
A is built on the FIDO2 and WebAuthn standards. When you create one, your device generates a pair of keys. The public half goes to the service you are signing in to. The private half stays where it was created and never travels, so there is no shared secret sitting in a database waiting to be breached.
The property that matters most is domain binding. A passkey created for your real bank will not respond to a lookalike domain, no matter how convincing the page is. That is a different kind of protection from a code sent by SMS or generated in an authenticator app, both of which a person can be talked into typing into the wrong window.
There are two kinds, and the difference decides whether a passkey satisfies a compliance requirement. A synced passkey is stored in a personal cloud account, usually Apple, Google or Microsoft, and follows you between devices. A device-bound passkey lives on one piece of hardware, such as a security key, and cannot be copied off it.
Synced passkeys are excellent for consumer accounts and convenient for staff. Device-bound passkeys on a hardware key are what most frameworks have in mind when they call for phishing-resistant multi-factor authentication, because the credential cannot be extracted, shared or recovered from someone else's cloud account.
Whether you need hardware keys or whether synced passkeys are enough depends on what you are protecting and who is asking. Our store has a guide on exactly that question.