Passwords have been the main way to protect online accounts for decades, and they have never worked particularly well. People reuse them, forget them, write them down and type them into fake websites. Data breaches expose millions of them at a time. The tech industry has finally settled on a replacement, and you have probably already seen it offered on sign in screens: the passkey.

This guide explains what passkeys are, how they work behind the scenes, why they are more secure than passwords and how to start using them without locking yourself out.

What Is a Passkey?

A passkey is a way to sign in to a website or app without typing a password. Instead, you confirm it is you using the same method you use to unlock your device: a fingerprint, face scan, PIN or pattern.

Passkeys are built on open standards developed by the FIDO Alliance and the World Wide Web Consortium, often referred to as FIDO2 and WebAuthn. They are supported by Apple, Google and Microsoft, as well as a growing list of major websites, banks, shopping platforms and social networks.

How Passkeys Work

You do not need to understand the technology to use passkeys, but knowing the basics helps explain why they are so secure.

A Pair of Keys

When you create a passkey for a website, your device generates two linked digital keys:

• A private key, which stays securely on your device or in your password manager and is never sent to the website.
• A public key, which is stored by the website.

Signing In

When you sign in, the website sends your device a unique challenge. Your device uses the private key to sign that challenge, but only after you unlock it with your fingerprint, face or PIN. The website checks the signature using the public key it holds. If it matches, you are in.

Crucially, your biometric data never leaves your device, and the private key is never shared with the website.

Why Passkeys Are More Secure Than Passwords

Nothing Useful to Steal

If a website storing passwords is breached, attackers may obtain password data they can crack and reuse. If a website storing passkeys is breached, attackers only get public keys, which are useless without the matching private keys held on users’ devices.

Built In Phishing Protection

Phishing works by tricking people into typing their password into a fake website that looks real. Passkeys are tied to the exact web address they were created for. A passkey created for a real banking site simply will not work on a lookalike domain, so even a convincing fake page cannot capture it.

No Reuse

Every passkey is unique to a single site or app. There is no way to reuse a passkey across services, which removes one of the biggest causes of account takeovers.

Strong by Default

Passwords are only as strong as the person creating them. Passkeys are generated by the device using strong cryptography, so there are no weak passkeys.

Where Are Passkeys Stored?

Passkeys are stored in a credential manager. Common options include:

• iCloud Keychain on Apple devices, which syncs passkeys across your iPhone, iPad and Mac.
• Google Password Manager on Android and in Chrome, which syncs across devices signed into your Google account.
• Windows Hello on Windows computers.
• Third party password managers that now support passkeys and can sync them across different operating systems.

Synced passkeys mean that if you lose or replace a phone, your passkeys can be restored to a new device once you sign back into your account.

Hardware Security Keys

Physical security keys, small devices that plug into a USB port or connect by NFC, can also store passkeys. They are popular with people who want the highest level of protection, as the private key never leaves the physical device.

How to Set Up a Passkey

The exact steps vary by website, but the process is usually similar:

1. Sign in to your account using your existing password.
2. Open the account or security settings.
3. Look for an option such as “Passkeys”, “Create a passkey” or “Sign in with a passkey”.
4. Follow the prompt and confirm with your fingerprint, face or device PIN.
5. Choose where to save the passkey if your device asks.

Next time you sign in, choose the passkey option and confirm with your device unlock.

Signing In on Another Device

If you want to sign in on a computer that does not have your passkey, many sites display a QR code. Scan it with your phone, confirm on the phone and the computer signs in. Your phone must be nearby, as this process uses Bluetooth to confirm proximity, which also helps prevent remote attacks.

Common Questions and Concerns

What If I Lose My Phone?

If your passkeys are synced through your account’s credential manager, they will be available on your other devices and on any new device after you sign in. It is still wise to keep account recovery options up to date, such as a recovery email, phone number or backup codes.

Can Someone Use My Passkey If They Steal My Phone?

They would also need to unlock the device with your fingerprint, face or PIN. Use a strong device PIN rather than a simple four digit code, and enable remote locking and erasing features.

Do I Still Need a Password?

For now, many services keep a password on your account as a backup. Over time, more services are expected to allow passkey only accounts. Until then, use a password manager to keep remaining passwords strong and unique.

Are Passkeys Private?

Passkeys do not share biometric information with websites, and each passkey is unique to one service, which makes it harder for companies to track you across sites using your login.

Tips for Moving to Passkeys

• Start with your most important accounts: email, banking, cloud storage and social media.
• Keep at least two ways to access critical accounts, such as passkeys on two devices or a hardware key as backup.
• Make sure your device’s operating system and browser are up to date.
• Review saved passkeys occasionally and remove ones for accounts you no longer use.

Final Thoughts

Passkeys solve the most serious problems with passwords. They cannot be reused, guessed or easily phished, and they make signing in faster at the same time. Setting them up takes only a minute per account, and the security improvement is significant. As more websites adopt them, the days of remembering dozens of complicated passwords are finally coming to an end.