who's /huːz/
It contracts who has (and who is). The apostrophe marks the dropped ha; the s gives /z/ after /uː/.
Who's got the keys?
Trap: who's is a homophone of whose /huːz/, the possessive, which takes no apostrophe. The two sound identical, but only the contraction carries the apostrophe marking the dropped ha.
Who's is the standard contraction of who has, pronounced /huːz/, and it is completely common and accepted in everyday English. In formal or academic prose, many editors prefer who has written out in full; who's belongs to everyday speech and informal writing, so the choice is a matter of register rather than correctness.
In standard varieties, who's and whose share the pronunciation /huːz/. The /w/, /uː/ and /z/ sounds are identical, so sound alone cannot separate them; only the spelling and the apostrophe do.
The trap runs the other way too. Because apostrophe-s usually marks possession, writers reach for who's in possessive phrases. The possessive is whose, with no apostrophe: Whose coat is this?
In this card, who's contracts who has. The same spelling also contracts who is, and context tells the two apart: Who's been here? uses who has, while Who's ready? uses who is.