A passkey is a sign-in method that replaces your password with a cryptographic key stored on your phone, computer or security key. You confirm it with your fingerprint, face or device PIN, and the website never receives anything a criminal could reuse. This guide explains how passkeys work, why they stop phishing, and how to set one up on your main accounts in a few minutes.
Key takeaways
- A passkey is a key pair: the private key stays on your device and the website only stores the public key.
- Passkeys cannot be phished or reused, because they only work on the real website they were created for.
- Google, Apple and Microsoft accounts all support passkeys today.
- Keep a backup sign-in method, such as a second device or recovery codes, before you remove your password.
What is a passkey and how does it work?
A passkey is a pair of matching cryptographic keys created when you register with a website. The private key stays on your device, and the website stores only the public key, so a breach of the website exposes nothing that can be used to sign in as you.
When you sign in, the website sends a one-time challenge. Your device signs it with the private key after you confirm with your fingerprint, face or PIN. The website checks the signature with the public key. Passkeys are built on the FIDO2 and WebAuthn standards, which we compare in FIDO2 vs WebAuthn. The FIDO Alliance maintains the standard.
Why are passkeys safer than passwords?
Passkeys are safer than passwords because there is nothing to type, guess, reuse or steal from a server. A passkey only works on the exact website that created it, so a fake login page cannot capture it, which defeats most phishing attacks.
| Sign-in method | Can be phished? | Leaks in a website breach? | Effort for you |
|---|---|---|---|
| Password only | Yes | Yes (hashed, often cracked) | Remember or store it |
| Password + SMS code | Yes, with real-time phishing kits | Password yes | Wait for a text |
| Password + authenticator app | Yes, with real-time phishing kits | Password yes | Open the app |
| Passkey | No | No usable secret | Fingerprint, face or PIN |
Most account takeovers start with a stolen or reused password. Our guide to password management best practices covers what to do for sites that do not support passkeys yet.
How do you set up a passkey?
You set up a passkey from the security settings of each account. The process takes about a minute: choose “create a passkey”, confirm with your fingerprint, face or PIN, and the key is saved to your phone, computer or password manager.
- Google account: go to Security, then Passkeys, and create one. Google explains the steps in its passkey help page.
- Apple ID and Apple devices: passkeys sync through iCloud Keychain, as described in Apple’s passkey guide.
- Microsoft account: add a passkey under Advanced security options.
- Work accounts: ask your IT team whether your identity provider supports passkeys or FIDO2 security keys.
- Test it: sign out and sign back in with the passkey before you rely on it.
What happens if you lose the device with your passkey?
If you lose a device, you can still sign in with a passkey synced to your other devices, a second passkey, or the account’s recovery options. Synced passkeys from Apple, Google and most password managers are backed up to your account automatically.
Cyber Snowden recommends keeping at least two ways in: a synced passkey on your phone plus either a hardware security key or printed recovery codes stored somewhere safe.
Should businesses switch to passkeys?
Yes, businesses should start with passkeys or FIDO2 security keys for email, admin and remote access accounts, because these are the accounts attackers target first. Phishing-resistant sign-in removes the most common path into a company.
Start with administrators, then finance staff, then everyone else. Our identity and access management guides cover the tools that make the rollout manageable.
Frequently asked questions
Is a passkey the same as a password manager?
No. A password manager stores passwords, while a passkey replaces the password entirely. Many password managers can now store passkeys too, which lets you use the same passkey across different browsers and operating systems.
Can someone steal my passkey if they hack the website?
No. The website only stores your public key, which cannot be used to sign in. The private key never leaves your device, so a breach of the website does not expose anything an attacker can reuse.
Do passkeys work on every website?
Not yet. Large services such as Google, Apple, Microsoft, Amazon and many banks support passkeys, but many smaller sites still use passwords. Use a password manager with unique passwords for those.
Can my family member use my fingerprint-protected passkey?
Only if they can get into your device. A passkey is protected by your device lock, so anyone who knows your phone PIN could use it. Keep your device PIN private and use a strong one.
Next steps
A passkey is the simplest security upgrade most people can make this week: it is faster than a password and cannot be phished. Set one up on your email account first, then your other important accounts. To see how the rest of your security measures up, take our free Cybersecurity Readiness Assessment.
