What Is a Passkey and Should I Use One?
A passkey replaces a password with a cryptographic key stored on your device and unlocked by your fingerprint, face or PIN. It cannot be phished or reused.
In short
A passkey is a login credential stored on your phone or computer that replaces a password. It uses public-key cryptography: the site holds a public key, your device holds the private one, and you approve each login with your fingerprint, face or device PIN. Because nothing secret is typed or sent, passkeys cannot be phished, leaked in a breach or reused across sites.
Passwords are the weakest part of almost every account, and not because people choose bad ones. They are weak because the same secret is typed into a box, sent over the network, stored by the service, and reused elsewhere, and every one of those steps can be attacked. Passkeys remove all four.
How a passkey works
When you create a passkey for a site, your device generates a pair of keys. The public key is sent to the site and stored. The private key never leaves your device.
To log in, the site sends a challenge. Your device signs it with the private key after you approve with a fingerprint, face or PIN, and sends the signature back. The site checks the signature against the public key. At no point is a secret typed, transmitted or stored on the server.
That is the entire mechanism, and it is the same one that secures online banking behind the scenes.
Why it beats a password
It cannot be phished. The passkey is tied to the exact domain it was created for. A fake site with a similar address cannot trigger it, because the browser will not offer a passkey for a domain that does not match.
It cannot leak. The site holds only a public key, which is useless to an attacker. A breach of the service exposes nothing that lets anyone log in.
It cannot be reused. Each passkey is unique to one site. There is no such thing as using the same passkey on two services.
It cannot be guessed or brute-forced. There is no string to guess.
Why it beats a password plus a code
Two-factor codes from an app or SMS help, and they are still vulnerable to a real-time phishing site that asks for the password and then the code, and relays both to the real service. That attack is common. A passkey defeats it, because the fake site cannot get a valid signature.
Setting one up
Most major services now offer passkeys in their security settings: Google, Apple, Microsoft, Amazon, PayPal, GitHub and a growing list. The steps are usually:
- Sign in with your current password.
- Go to security settings and choose to add a passkey.
- Confirm with your fingerprint, face or PIN.
- Optionally, remove the password or keep it as a fallback.
On a phone the passkey is stored in the platform’s keychain and syncs to your other devices signed into the same account. Some password managers store passkeys too.
Losing your device
Because passkeys sync through your Apple or Google account, a new phone restores them. The account itself is the thing to protect: strong recovery options, a second trusted device, and any recovery codes the service gave you, kept somewhere safe.
It is also sensible to register a second passkey on a different device, or a hardware security key, for accounts that matter.
Should you use them
Yes, everywhere they are offered, starting with your email account, since it is the recovery route for everything else. Keep a password manager for the sites that have not caught up, and expect the number of those to shrink each year.
Common questions
What happens if I lose my phone?
Passkeys sync through your platform account, such as Apple iCloud Keychain or Google Password Manager, so a new device restores them. Most services also let you keep a second method, such as a security key or a recovery code, for exactly this situation.
Are passkeys safer than a password plus two-factor?
Yes, materially. A password with a code from an app can still be phished by a convincing fake site that relays both in real time. A passkey is bound to the real site's domain and simply does not work on a fake one.
Do I still need a password manager?
For now, yes. Passkey support is spreading but many sites still use passwords, and a manager also stores the passkeys themselves on some platforms. The two coexist during the transition.
Sources
Every factual claim above traces to one of these. Follow them rather than taking this article's word for it.
- Passkeys FIDO Alliance
- Use a strong and separate password for your email National Cyber Security Centre
- Setting up 2-step verification National Cyber Security Centre
Try it yourself
Free, instant, and nothing you enter leaves your browser.