
Re: "It is faster using pass keys"
simple: passkeys are not "pass phrases", and "takes 2 seconds or less" is alo valid for using passkeys.
.
passkeys are actually public / private certificate pairs (ECDSA usually) that are unique for each particular service because when they are created they are also seeded with service ID data that is unique for each of them (usually based on domain name - but not always).
This way a passkey that was made for one service (e.g. Microsoft account) will never even be recognized (or prompted) by another service (e.g. Google account) because the service seed ID data is different.
The private certificate key of the passkey is never leaving the secure location (either a FIDO2 device. Windows Hello, Bitwarden store or other equivalent) and when authenticating that service is actually sending a request for a digital signature that the secure location is using when signing a response challenge with the same digital certificate key that was used when creating the passkey. The service then uses the public certificate that was enrolled when the passkey was created to verify that the challenge was signed by the correct certificate key.
This is also why you can never "save" or copy a secure USB FIDO2 hardware token / security key and why it is needed to have at least two such USB token devices - in case one of them breaks or is lost you have a backup already defined. Software-based passkeys though (e.g. Bitwarden)...that's another kettle of fish.