Passkeys resist phishing where authenticator codes can be intercepted. Compare security models, recovery tradeoffs and migration priorities.