FIDO2
An open authentication standard using public key cryptography, implemented by security keys and passkeys.
A key pair is generated per site. The private key never leaves the device, and the signature is tied to the exact origin requesting it, which makes credential replay and lookalike-domain phishing structurally impossible rather than merely difficult.
Hardware keys are the most robust form for administrative accounts, since the credential cannot be extracted by malware on the machine the way a software certificate sometimes can.
Where this comes up
FIDO2 sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.