Registration. The device (a phone, laptop TPM, or security key) generates an asymmetric key pair locally: a private key that is sealed inside the device's secure hardware and a matching public key. Only the public key — plus a credential ID — is sent to the server (the "relying party") and stored against the account. The private key is never transmitted, never typed, and never stored on any server.

Authentication. On login the server sends a random, single-use challenge. The device signs that challenge with the private key, and the signature — along with the origin (domain) it was generated for — is sent back. The server verifies the signature against the stored public key. Nothing secret ever crosses the network.

Why phishing fails. The signature request is scoped to the exact origin the credential was registered for. A look-alike domain gets a different origin string, so the authenticator either refuses to produce a signature or produces one that fails verification — there is no password for a victim to be tricked into typing on the wrong site.

• Asymmetric cryptography replaces a shared secret
• Public key theft from a server is not enough to log in as the user
• Each relying party gets its own key pair — no credential reuse across sites