🔑 Passkeys Quiz & Answers

For Cybersecurity Month · Oct 2026

Passkeys Awareness Quiz

Part 1 — Why passwords let us down

Q1. Reusing the same password across multiple websites is safe, as long as the password is long and complex.

Answer: False

Explanation: Length and complexity don't help if one site is breached — attackers take that leaked password and try it everywhere else you used it (called "credential stuffing"). Reuse is the risk, not weakness.

Q2. A password only protects you if it stays secret — the moment someone else learns it, they can log in as you from anywhere in the world.

Answer: True

Explanation: Passwords are a "shared secret." Because they're knowledge you can type, they can be typed by anyone who obtains them — no physical device required.

Q3. Phishing works by tricking you into typing your real password into a fake website that looks just like the real one.

Answer: True

Explanation: The fake site captures whatever you type and relays it to the attacker. This is why even careful, security-aware people get caught — the fake page can be a near-perfect copy.

Q4. If you turn on a one-time SMS code (a text-message code) on top of your password, phishing can no longer steal your login.

Answer: False

Explanation: A convincing fake site can ask for the SMS code too, and relay it in real time before it expires. SMS codes raise the bar but are still "phishable" because you can be tricked into handing them over.

Part 2 — How passkeys change the game

Q5. A passkey is essentially just a longer, stronger password stored in your browser.

Answer: False

Explanation: A passkey is not a secret you type at all. It's a pair of cryptographic keys — a public key held by the website and a private key that stays on your device. Nothing typeable is ever shared.

Q6. With a passkey, the private key that proves your identity never leaves your device — not even when you sign in.

Answer: True

Explanation: Instead of sending a secret, your device signs a unique challenge from the site and sends back only the signature. The private key itself never travels across the internet, so there's nothing for a fake site to capture.

Q7. To use a passkey, you typically confirm with something on your own device — like a fingerprint, face scan, or device PIN.

Answer: True

Explanation: The biometric or PIN unlocks the passkey locally on your device. It's never sent to the website, so it can't be stolen or reused elsewhere.

Q8. A passkey is tied to the exact website it was created for, and your device will refuse to use it on a look-alike phishing site.

Answer: True

Explanation: This is the key difference. The passkey is bound to the real site's web address. On a fake domain, the browser simply won't offer the passkey — so there's nothing to trick out of you.

Part 3 — Putting it together

Q9. Because there's no secret to type, a passkey can't be phished, leaked in a website breach, or reused across sites the way a password can.

Answer: True

Explanation: Even if a website is hacked, attackers only get public keys — useless on their own. There's no shared secret to steal, phish, or reuse. This removes the single biggest cause of account takeovers.

Q10. Switching to passkeys means you have to memorize an even more complicated secret than before.

Answer: False

Explanation: There's nothing to memorize at all. Passkeys are usually faster and safer than passwords — a quick fingerprint or face scan replaces typing, remembering, and resetting passwords.