What Is a Passkey? How It Works and Why It Beats Passwords

What is a passkey? It is a password replacement that lets you sign in to an app or website with the same face scan, fingerprint or PIN you use to unlock your phone or computer. Instead of a secret you type, your device holds a cryptographic key that never leaves it, so there is nothing for a fake login page to steal and nothing for a data breach to leak.

The question matters because most big platforms now push passkeys by default. Since May 2025, brand new Microsoft accounts are "passwordless by default", and Google, Apple, Amazon and many banks prompt users to create one at sign-in. If you have seen that prompt and skipped it, here is what you would get by saying yes.

What Is a Passkey and How Is It Different From a Password?

A password is something you remember and type. A passkey is a secret stored on your devices and unlocked with biometrics, a PIN or a pattern. The FIDO Alliance, the industry group behind the standard, describes it as a credential that is always strong, resistant to phishing and designed so that there are no shared secrets between you and the website.

That last point is the real difference. With a password, the website stores something it can check your typing against. If that database leaks, or you type the password into a convincing fake page or a watering hole attack site, attackers can reuse it. With a passkey, the website only ever holds a public key, which is useless on its own.

Passkeys are not a single company's feature, either. The word is a generic term, like "password", and the same passkey system works across iPhone, Android, Windows, Mac and most major browsers.

How Do Passkeys Work?

Passkeys use public key cryptography, the same math that secures websites. When you create a passkey for an account, your device generates a matching pair of keys just for that site:

• The public key goes to the website's server. It is not secret, and the server never learns anything that would let it sign in as you.
• The private key stays on your phone, computer or hardware security key. It is the part that actually proves who you are.

When you sign in, the site sends a one-time challenge. Your device asks you to unlock it with your face, fingerprint or PIN, then signs that challenge with the private key and sends back the answer. The site checks the answer with your public key. As a result, no reusable secret ever crosses the internet.

Your biometric data stays on the device as well. The site only learns that the unlock check succeeded, not what your face or fingerprint looks like.

Why Are Passkeys Safer Than Passwords Plus 2FA?

A passkey is tied to the real web address it was created for. If a phishing email sends you to a lookalike domain, your device simply has no passkey for that address, so there is nothing to hand over. In contrast, a password and a six-digit text code can both be typed into a fake page and relayed to attackers in real time.

That is why the FIDO Alliance says a passkey on its own is more secure than "password + OTP" or "password + phone approval". It also explains why security agencies keep telling people to drop SMS codes for important accounts, a point we covered in our guide on how to know if your phone is hacked.

Speed is the other selling point. Microsoft says passkey users get into their accounts about 98% of the time, compared with 32% for password users, and that passkey sign-ins are eight times faster than a password plus multifactor authentication.

Where Are Passkeys Stored?

Passkeys live with a passkey provider, which creates, stores and syncs them. There are three common options:

• Built-in managers: iCloud Keychain on Apple devices and Google Password Manager on Android and Chrome. These sync your passkeys with end-to-end encryption to every device signed in to the same account.
• Third-party managers: apps such as 1Password, Dashlane or Bitwarden, which can make it easier to move between Apple, Google and Windows devices.
• Hardware security keys: USB or NFC keys that hold "device-bound" passkeys. The key never leaves the hardware, which gives the highest assurance but no cloud backup.

Synced passkeys are convenient because a new phone gets them as soon as you sign in. However, that also means the account that syncs them, such as your Apple Account or Google Account, becomes the most important account you own and needs strong protection of its own.

How Do You Create and Use a Passkey?

For most people, the simplest path is to wait for the prompt. After you sign in with a password, many services offer to "create a passkey" or "sign in faster next time". For Google, you can also start it yourself:

1. Make sure your phone or computer has a screen lock turned on. On an iPhone, iPad or Mac, turn on iCloud Keychain too.
2. Go to your Google Account's passkey page and choose Create a passkey.
3. Confirm with your fingerprint, face or PIN.
4. Next time, enter your username and approve the sign-in on your device.

Google's passkey help page lists the minimum requirements: Windows 10, macOS Ventura, ChromeOS 109, Android 9 or iOS 16, plus Chrome or Edge 109, Safari 16 or Firefox 122 and newer. To sign in on a computer that does not have your passkey, choose the passkey option, scan the QR code with your phone and keep Bluetooth on so the two devices can confirm they are close to each other.

What Are the Downsides of Passkeys?

Passkeys are a big upgrade, but they come with trade-offs worth knowing:

• Shared devices are risky. Google warns that anyone who can unlock a device holding your passkey can get into your account, so only create passkeys on devices you personally use.
• Passwords often stay on the account. Adding a passkey usually does not delete your password, so a phished password can still work until you remove it where the service allows.
• Switching ecosystems takes planning. Moving from iPhone to Android is easiest with a cross-platform password manager; otherwise you may have to sign in on the new phone and create fresh passkeys.
• Support is uneven. Many sites still offer passkeys only as a second step, and some workplace accounts limit passwordless sign-in.

Should You Switch to Passkeys?

Yes, for your most important accounts: email, your phone's cloud account, banking, crypto exchanges and shopping sites that store your card. Those are the accounts that phishing campaigns and stolen password lists target most, and the recent Binance hack is a reminder of how much is at stake when attackers get in.

In our view, passkeys are the rare security upgrade that is also easier to use than what it replaces. The practical approach is to turn them on whenever a service offers them, keep the account that syncs them locked down with a strong unique password and two-factor authentication, and add a hardware security key as a backup if you want maximum protection.