- A passkey replaces your password with a secure cryptographic key stored on your device.
- Passkeys resist phishing because they only work on the real website.
- Keep a password manager and recovery options, since many sites still use passwords.
The Short Answer
A passkey is a modern sign-in method that lets you log in with your fingerprint, face or device PIN instead of typing a password. It is built on a standard from the FIDO Alliance and supported by major companies including Apple, Google and Microsoft. Because there is no secret password to steal, guess or type into a fake website, passkeys are much harder to phish. Passwords are not gone yet, but passkeys are becoming common on big services.
How Passkeys Work
When you create a passkey, your device makes a pair of keys. The public key is stored by the website, while the private key stays on your device and never leaves it. To sign in, your device proves it has the private key after you unlock it with a fingerprint, face or PIN. The website never receives a password that could be stolen from its servers.
Passkeys vs Passwords
| Password | Passkey | |
|---|---|---|
| Can be guessed | Yes | No |
| Can be phished | Yes | Resistant |
| Reused across sites | Often | Never, each site has its own |
| Convenience | Typing and remembering | One touch or glance |
How to Set One Up
- Open the security settings of a supported account, such as your Google or Apple account.
- Choose 'Create a passkey' or 'Use passkeys'.
- Confirm with your fingerprint, face or device PIN.
- Test signing in on a second device or private window.
Passkeys can sync through your phone's account or a password manager, so you can use them on more than one device.
What to Watch For
- Keep your phone's screen lock strong, because it unlocks your passkeys.
- Set up account recovery in case you lose your phone.
- Many sites still need a password, so keep using a manager. See how to set up a password manager and 2FA and compare 1Password and Bitwarden.
- Stay alert to scams: see how to stop phishing and SIM swap fraud.
Action Checklist
- Enable passkeys on your main email account
- Set a strong phone screen lock
- Add recovery options
- Keep a password manager for other sites
- Turn on 2FA wherever passkeys are not offered
