Registration creates a key pair on an authenticator (a phone, a computer's platform authenticator or a security key); the site stores only the public key and a credential ID. Signing in, the browser sends a challenge, the authenticator checks the user and signs the challenge together with the site's RP ID hash, and the server verifies the signature. Most passkeys use ES256 (COSE −7); some use EdDSA or RS256.
Synced passkeys are backed up and copied across a user's devices by a credential manager (iCloud Keychain, Google Password Manager, 1Password and others) and carry the backup-eligible flag; device-bound passkeys live in one authenticator such as a security key and cannot be copied. Cross-device sign-in uses the hybrid transport (a QR code plus a Bluetooth proximity check). FIDO's credential exchange formats (CXF, with the CXP protocol still in draft) let users move passkeys between managers.
What a server must still get right: random challenges with short lifetimes, RP ID and origin checks, user-verification policy, account recovery that does not reintroduce a weaker factor, and storing several passkeys per account. The passkey sandbox runs a full registration and sign-in locally.