A passkey is a way to sign in to apps and websites without a password. Instead of typing a secret, you unlock your phone or computer with your fingerprint, face or PIN, and your device proves who you are. This guide explains what a passkey is, how it works, why it is safer than a password, and how to set one up on Google, Apple, Microsoft and other accounts.
What Is a Passkey, in Plain Terms?
A passkey replaces your password with a pair of digital keys:
- A public key, which is stored by the website or app.
- A private key, which stays on your device and never leaves it.
When you sign in, the website sends a challenge to your device. Your device signs it with the private key after you unlock it with your fingerprint, face or PIN. The website checks the signature using the public key. If it matches, you are in.
You never type anything, and the website never sees your private key. Passkeys are built on open standards from the FIDO Alliance, an industry group that includes Google, Apple and Microsoft, so they work across most modern devices and browsers.
Passkey vs Password: What Is the Difference?
- Nothing to steal from you. A password can be guessed, reused or tricked out of you. A passkey cannot be typed into a fake page, because there is nothing to type.
- Nothing useful to steal from the company. When a company’s password database is breached, criminals can try those passwords elsewhere. A breached public key is useless on its own.
- Built-in phishing protection. A passkey only works on the exact website it was created for. A lookalike site cannot use it, even if you are fooled into visiting it.
- Faster. Signing in takes a touch or a glance instead of typing a password and a code.
Is a Passkey the Same as Two-Factor Authentication?
Not exactly, but it does the same job better. Two-factor authentication adds a second step, such as a code sent by text, on top of a password. A passkey combines two factors in one step: something you have (your device) and something you are or know (your fingerprint, face or PIN).
Codes sent by text message can be intercepted or tricked out of you, which is how many accounts are taken over. Our guides Facebook Account Hacked? and Instagram Account Hacked show how often that happens. Passkeys close that gap.
A passkey is a small step towards identity that lives with you instead of on a company’s server. That idea is at the core of Wes Kussmaul’s Escape the Plantation, and you can get a free copy at the end of this article.
How to Set Up a Passkey
The exact steps vary, but the process is similar everywhere. You need a reasonably recent device, such as an iPhone on iOS 16 or later, an Android phone on Android 9 or later, a Windows 10 or 11 computer, or a Mac on macOS 13 or later.
Go to your Google Account, open Security, and choose Passkeys and security keys. Select Create a passkey and follow the prompts. Google stores passkeys in Google Password Manager, which syncs them to your other signed-in devices.
Apple
On Apple devices, passkeys are saved in iCloud Keychain. When a website or app offers a passkey, accept it and confirm with Face ID or Touch ID. It then syncs to your other Apple devices signed in to the same Apple Account.
Microsoft
Sign in to your Microsoft account, go to Security, and look for the option to add a passkey or a new sign-in method. Windows Hello lets you confirm with your face, fingerprint or PIN.
Other sites
Many services, including Amazon, PayPal, WhatsApp, Facebook and major banks, now offer passkeys. Look in the account’s security or login settings for “passkey”. If a site offers to create one when you sign in, it is usually worth accepting.
What Happens If You Lose Your Phone?
This is the most common worry, and it is manageable if you plan ahead:
- Synced passkeys survive. If your passkeys are stored in iCloud Keychain, Google Password Manager or a password manager such as 1Password or Bitwarden, you can sign in on a new device and they return.
- Set up more than one device. Add passkeys on your phone and your computer, so losing one does not lock you out.
- Keep a backup method. Leave a recovery email, phone number or backup codes set up on important accounts.
- Remove the lost device. Sign in to your account from another device and delete the passkey linked to the lost one.
The Limitations of Passkeys
- Not every site supports them yet, so you will still need passwords for some accounts.
- Moving between ecosystems can be awkward. iCloud Keychain does not sync to Android, for example. A cross-platform password manager can solve this.
- Shared devices need care. Do not create passkeys on a computer other people use.
- Account recovery is still the weak point. If a site lets anyone reset your account by text message, attackers may target that instead.
Why Passkeys Matter for Your Digital Identity
Passwords put the burden of security on you, while the real secrets sit on a company’s server waiting to be breached. Passkeys flip that: the secret stays with you, on your device. It is a small but meaningful shift in who holds your identity online, a question we explore in Digital ID Privacy: Who Holds Your Data Changes Everything and Digital Identity Explained.
Frequently asked questions
What is a passkey and how does it work?
A passkey is a password replacement made of two keys: a public key held by the website and a private key kept on your device. You unlock the private key with your fingerprint, face or PIN, and your device uses it to prove who you are without sending any secret to the website.
Is a passkey safer than a password?
Yes. Passkeys cannot be guessed, reused or typed into a fake website, and a breach of the company’s servers does not expose anything an attacker can use to sign in as you.
What is a passkey for Google?
It is a way to sign in to your Google Account using your phone or computer’s screen lock instead of your password. You can create one under Security in your Google Account settings.
What happens to my passkeys if I lose my phone?
If they were synced through iCloud Keychain, Google Password Manager or a password manager, you can recover them by signing in on a new device. It is best to set up passkeys on more than one device and keep a backup recovery method.
Do I still need a password if I use a passkey?
Often, yes, for now. Many accounts keep your password as a fallback, and some sites do not support passkeys yet. Use a strong, unique password alongside your passkey.
Related reading
- Facebook Account Hacked? Here Is How to Get It Back
- Instagram Account Hacked: How to Recover It
- Digital Identity Explained: What It Is and What It Isn’t
- Digital ID Privacy: Who Holds Your Data Changes Everything
Passkeys show what changes when you hold your own identity instead of trusting a company to guard it. Wes Kussmaul’s Escape the Plantation takes that idea much further, explaining how identity you own and control could keep people accountable but anonymous across the whole internet. Enter your email below to get your free copy and follow CDM Worlds’ work on safer online communities.
