Settings → Security → Add a passkey.
The private key never leaves your device. This server stores only the public half, so there is nothing here that can be stolen and replayed — a database breach yields public keys, which are public by definition.
Passkeys are bound to this exact origin, which is what makes them unphishable: a look-alike site cannot use them at all, even if you are fooled.
Two protections worth knowing about:
- Replay is impossible. Every challenge is single-use and stored server-side.
- Cloned authenticators are detected. If a credential's signature counter fails to advance, sign-in is refused and you are told to remove and re-register it.
Removing your last sign-in method is refused. If a passkey is the only way into your account, set a password or add a second passkey first.
Note: a passkey registered against localhost will not work once the app moves to a real domain. Register again after deployment.