When a user creates a passkey, their device generates a key pair. The public key goes to your server and the private key never leaves the user's device or password manager. To sign in, your server sends a random challenge, the device signs it after the user unlocks it, and your server checks the signature against the stored public key. Browsers expose this through the Web Authentication API, known as WebAuthn, which is a W3C standard.
Two properties matter for a founder. First, your database holds only public keys, so a breach of your server does not hand attackers anything they can log in with. Second, each passkey is bound to the website it was created for, so a look-alike phishing domain cannot ask for it. That removes the two largest password problems: reuse and phishing.
Passkeys do not remove the need to think about account recovery, which becomes the weakest route in. If a lost device falls back to an emailed link, your account security equals the security of that email flow. Use a maintained WebAuthn library or your auth provider's passkey support instead of hand-written cryptography, generate a fresh random challenge on the server for every attempt and verify the origin in the response.