What is 'passkey' authentication on mobile and how does it replace traditional passwords from both a user experience and security perspective?

• A.Passkeys use device biometrics to derive a 256-bit password that is sent to the server for verification; they improve security by replacing text passwords with biometric-derived ones but still require server-side password storage
• B.Passkeys are enhanced PINs that use AES-256 encryption of the user's memory-derived passphrase, stored in cloud backup for cross-device use - stronger than passwords because they are longer and randomly generated
• C.Passkeys replace SMS-based 2FA by generating a one-time 6-digit code using the device's Secure Enclave; they are equivalent in security to TOTP but do not require a separate authenticator app
• D.Passkeys (FIDO2/WebAuthn based) use an asymmetric key pair stored on the device (private key in Keystore/Secure Enclave, public key registered with the service); authentication requires local biometric/PIN without sending any password to the server. Security improvements over passwords: phishing-resistant (keys are domain-bound), no password database for attackers to breach, no credential stuffing (keys are device-specific), resistant to replay attacks (challenges are unique per authentication)