It might help to think of them like that, but they aren't the same in some pretty important ways. The website never gets access to your private key like they do with passwords.

So even if a website has it's database breached, there isn't a need to reset your passkeys since they were never compromised. I guess maybe you might have to be sure the attacker didn't replace your pub key with their own.

Just in case you (or someone reading) doesn't know the technical details, private keys are distinctly different from passwords, on how they work to authenticate the user.

In case of an online login, a password travels to the server, and gets checked against its stored form, to see if the user's login request is valid.

In case of a private key, the server sends a bit of data that the user signs digitally on their own device with their private key, sends back the signed data, and the server checks authenticity with the user's previously stored public key.

So at the end of the day, private keys are not essentially glorified passwords. Yes, both are strings that are used to authenticate. But it's their very essence itself that makes the difference.

I hope you are making a humorous understatement