Passkeys are a newer way to sign in that replaces your password with your fingerprint, face or device PIN. Apple, Google and Microsoft all support them, and a growing number of shops, banks and apps do too. This guide explains what a passkey is, why it is harder to steal than a password, and how to set one up without locking yourself out.
What is a passkey?
A passkey is a pair of cryptographic keys. One half, the public key, is stored by the website or app. The other half, the private key, stays on your device and is never sent anywhere. When you sign in, your device proves it holds the private key after you unlock it with a fingerprint, face scan or screen lock. Apple, Google and Microsoft built the system with the FIDO Alliance, as Dark Reading explains, so a passkey created on one platform follows an open standard rather than a single company’s rules.
Why passkeys are safer than passwords
Passwords can be guessed, reused, leaked in a breach or typed into a fake page. Passkeys avoid each of those problems:
- There is nothing to guess or reuse, because every site gets its own unique key pair.
- A passkey only works on the genuine site it was created for, so a look-alike phishing page cannot collect it.
- If a site is breached, the public key it holds is useless to attackers on its own.
Google says passkeys are more resistant to phishing than one-time codes sent by text message, as reported by Ghacks. That makes them a strong upgrade alongside the two-factor authentication you may already use.
Where your passkeys are stored
| Platform | Where passkeys are stored | How they sync |
|---|---|---|
| Apple iPhone, iPad and Mac | iCloud Keychain | Across devices signed in to the same Apple account |
| Android and Chrome | Google Password Manager | Across devices signed in to the same Google account |
| Windows and Edge | Windows Hello and Microsoft Password Manager | Through your Microsoft account |
| Third-party password managers | The manager’s own vault | Across any device where the manager is installed |
Third-party password managers such as 1Password and Bitwarden have added passkey support, according to Dark Reading. If you are weighing that option, our explainer on whether you need a password manager covers the trade-offs.
What you need before you start
Malwarebytes lists the basic requirements: a phone running at least iOS 16 or Android 9, a computer running Windows 10 or macOS 13 Ventura or newer, and a current browser such as Safari 16, Chrome 109 or Edge 109 or later. A FIDO-certified security key also works. Make sure your phone has a screen lock or biometric sign-in switched on, because that is what unlocks the passkey.
How to set up a passkey
The wording changes between services, but the pattern is the same. Sign in the usual way, open the account’s security settings, choose the option to create or add a passkey, and approve it with your fingerprint, face or screen lock.
More in Tech
- Google account: go to your Google Account, open Security, then Passkeys, and follow the prompts. Malwarebytes and PCSteps both point to g.co/passkeys as the shortcut.
- Apple devices: when a site or app offers to create a passkey, approve it with Face ID or Touch ID and it is saved to iCloud Keychain. The Passwords section of Settings lists what you have saved.
- Microsoft account: sign in, open Security settings and look for the option to add a passkey or turn on passwordless sign-in. Menu names change, so follow the on-screen wording.
- Other sites and apps: look for “Create a passkey” or “Sign in with a passkey” at sign-in or in security settings.
Start with the accounts that matter most: your email, your Apple, Google or Microsoft account, and any financial services that offer passkeys. You do not need to switch everything at once.
What happens if you lose your phone
This is the question most people ask first. Passkeys that sync through iCloud Keychain or Google Password Manager are backed up, so a new device signed in to the same account can restore them. If you lose every device that holds a passkey and have no sync, you will need the fallback methods on the account, such as a password, a recovery email address or a phone number, as Gizmodo notes. For that reason, keep your recovery details up to date and do not delete your password until you are comfortable with the passkey. Clark.com also points out that a passkey can be added as an extra sign-in method while your password still works.
Passkeys compared with passwords and codes
| Sign-in method | Can be tricked by a fake site | Can be reused across sites | You must remember it |
|---|---|---|---|
| Password | Yes | Yes, if you reuse it | Yes |
| Password plus text message code | Often yes | The password can be | Yes |
| Passkey | No, it only works on the real site | No, each site has its own | No, you unlock with your device |
Passkeys do not remove every risk. Someone who can unlock your phone could use them, so use a strong screen lock. If a service you use is breached, follow our advice on what to do after a data breach, and keep checking fake websites because scammers still try to trick people into handing over other details.
Frequently asked questions
Are passkeys safer than passwords?
Generally yes. They cannot be guessed or reused, and they only work on the genuine site, which makes phishing far harder.
Do I still need a password?
Often yes for now. Many sites let you keep your password as a fallback, and some services do not support passkeys yet.
Can I use the same passkey on my phone and laptop?
Yes, if your passkeys sync through iCloud Keychain, Google Password Manager, Microsoft or a password manager that works on both devices.
Are passkeys free?
Yes. Passkeys built into Apple, Google and Microsoft accounts cost nothing, although some third-party password managers charge for their own plans.
What if a site does not offer passkeys?
Keep using a unique password and switch on two-factor authentication until the site adds passkey support.
