Passkeys Explained: What They Are and How to Start Using Them

Passwords have been the standard way to access online accounts for decades, but they have familiar problems: people reuse them, forget them, and can be tricked into entering them on imitation websites. Passkeys are a newer sign-in technology designed to address many of those weaknesses.

So, what are passkeys? In simple terms, a passkey is a cryptographic credential that lets you sign in to a specific website or app without sending a reusable password to that service. You normally approve the sign-in using your device’s screen lock—such as Face ID, Touch ID, a fingerprint, Windows Hello, or a device PIN.

Passkeys are based on standards from the FIDO Alliance and World Wide Web Consortium (W3C), and they are supported across major platforms including Apple, Google, Microsoft, Android, iOS, macOS, Windows, and modern browsers. They offer meaningful protection against conventional phishing, although they do not make every type of account or device attack impossible.

This guide explains passkeys without assuming a technical background. It also covers passkeys vs. passwords, FIDO2, device-based login, iPhone passkeys, Google passkeys, cross-device sign-in, and what to consider before switching an important account to passwordless access.

Quick Takeaways

• A passkey uses public-key cryptography instead of sending a reusable password to a website.
• Passkeys are associated with the legitimate website or app, making them resistant to conventional phishing.
• You usually unlock a passkey with the same method you use to unlock your device, such as a PIN, fingerprint, Face ID, Touch ID, or Windows Hello.
• Your fingerprint or face is generally used locally to unlock the credential; the website does not receive your biometric data as a password.
• Passkeys may be stored on one device, synchronized securely through a credential provider, or held on a hardware security key, depending on your setup.
• Apple, Google, Microsoft, and many password managers support passkeys, but individual websites must support them too.
• Understand account recovery and passkey synchronization before removing your password or other backup sign-in methods.
• Passkeys offer strong security benefits, but they do not protect against every risk, including someone controlling an already-unlocked device or abusing an account’s weaker recovery process.

What Are Passkeys?

A passkey is a credential used to authenticate you to a website, application, or other online service. It is built on public-key cryptography rather than a shared password.

When you create a passkey, your device or credential provider creates a related pair of cryptographic keys:

• A private key, which remains protected by your device, password manager, credential provider, or hardware security key.
• A public key, which is registered with the website or service.

The website does not need your private key.

When you later sign in, the website asks your device to prove that it holds the correct private key. You approve the request, typically by unlocking the credential with your device PIN or biometric authentication.

Cryptography handles the verification in the background.

This design solves an important problem with passwords: there is no reusable secret that you need to type into the website.

How Does a Passkey Work?

Imagine you create a passkey for a fictional website called example.com.

During enrollment, your device creates a unique public-private key pair for that account. Example.com stores the public key. Your private key stays within your passkey system.

The next time you sign in:

1. Example.com sends your device an authentication challenge.
2. Your device confirms that you want to use the passkey.
3. You unlock it using your normal device authentication method.
4. The private key cryptographically signs the challenge.
5. Example.com verifies that signature using the public key it previously stored.
6. If everything matches, the service signs you in.

You never type the private key, and the website does not need to know it.

This process normally takes only a few seconds. To the user, it may look as simple as selecting “Sign in with a passkey” and approving Face ID or a fingerprint.

Passkeys vs. Passwords

Although both let you access an account, passkeys and passwords work very differently.

Feature	Password	Passkey
What authenticates you	A reusable secret	Public-key cryptography
Secret sent to website	Yes, through an encrypted connection	Private key is not sent
User must remember it	Usually, unless stored in a manager	No
Can be reused across websites	Yes, although reuse is unsafe	No traditional credential reuse
Susceptible to conventional phishing	Yes	Designed to be phishing-resistant
Can be weak or easily guessed	Yes	Not in the traditional password sense
Stored by website	Password verifier/hash rather than plaintext in properly designed systems	Public key
Unlocked with device PIN/biometric	Not necessarily	Commonly
May synchronize across devices	Through a password manager	Yes, depending on credential provider
Site support required	Nearly universal	Increasing, but not universal

Why passwords are vulnerable to phishing

Passwords are transferable secrets. If your legitimate password is ExamplePassword, the same characters can be entered into both the real service and a convincing imitation.

That creates an opportunity for phishing.

Passkeys work differently. The credential is cryptographically associated with the service for which it was created. A deceptive website at a different domain cannot simply ask you to type the passkey into a form.

That property is why passkeys are described as a form of phishing-resistant authentication.

What Does “Phishing-Resistant” Actually Mean?

The term should not be interpreted as “immune to every scam.”

Passkeys are strongly resistant to the common phishing technique of creating a fake login page and convincing a user to type a password or one-time authentication code into it. The authentication mechanism verifies the website or application’s identity before using the credential.

CISA recommends phishing-resistant multifactor authentication, particularly FIDO/WebAuthn-based methods, where available.

However, passkeys do not eliminate every security risk.

For example, a criminal could potentially manipulate someone into changing account recovery information after a legitimate login, or exploit a weaker recovery process offered by the service. An attacker with control of an unlocked device may pose a different risk. Software vulnerabilities can also exist.

A better description is that passkeys remove or substantially reduce several common password and phishing risks rather than solving all possible account-security problems.

What Are FIDO2 and WebAuthn?

Passkey discussions quickly produce several acronyms. You do not need to understand the technical details to use them, but knowing how the terms relate can make product descriptions less confusing.

FIDO

FIDO stands for Fast IDentity Online. The FIDO Alliance develops open authentication standards intended to reduce dependence on passwords.

Its members include major technology companies, financial institutions, security vendors, and other organizations.

WebAuthn

Web Authentication, usually called WebAuthn, is a web standard from the W3C developed with the FIDO Alliance. It allows browsers and websites to perform public-key authentication.

FIDO2

FIDO2 broadly refers to WebAuthn together with the FIDO Alliance’s Client to Authenticator Protocol (CTAP).

CTAP helps devices communicate with external or nearby authenticators, such as a hardware security key or another device.

Where passkeys fit

Passkeys build on FIDO authentication standards and make passwordless public-key credentials easier for ordinary consumers to use across devices.

You generally do not need to configure “FIDO2” manually. When a supported website offers to create a passkey, the operating system, browser, password manager, or security key handles the technical protocol.

Where Is a Passkey Stored?

This question matters because it determines where you can use the passkey and how you recover it.

A passkey can generally be managed through several types of systems.

Synced passkeys

Many consumers use a credential provider that securely synchronizes passkeys among authorized devices.

Examples include platform credential managers and compatible password managers.

If you create a passkey on an iPhone using Apple’s credential system, for example, it may be available on your other authorized Apple devices through the associated credential synchronization system. Google’s ecosystem similarly supports passkeys through compatible Android and Google credential-management features.

Exact synchronization and cross-platform capabilities evolve, so check your credential provider’s current documentation.

Device-bound passkeys

Some credentials are tied to a particular authenticator rather than being synchronized through a consumer credential provider.

These can be appropriate for situations requiring more controlled credential storage.

Hardware security keys

Compatible physical security keys can hold FIDO credentials. These are especially useful for people or organizations seeking stronger physical separation and controlled authentication.

A security key is not necessary for most people to start using passkeys.

Is a Passkey the Same as Your Fingerprint or Face?

No.

This is an important distinction.

When you use Face ID, Touch ID, Windows Hello, or Android biometric authentication to approve a passkey login, your biometric is generally being used locally to confirm that you are allowed to use the private credential stored or managed by that device.

The website does not receive a copy of your fingerprint or face as the passkey.

The simplified process is:

You → unlock device credential → device uses private key → website verifies cryptographic proof

Your biometric is therefore not functioning like a password that gets transmitted to each website.

If biometric authentication is unavailable, your device may allow its PIN, passcode, or another approved local authentication method instead.

Is a Device PIN the Same as an Online Password?

No.

A device PIN, such as a Windows Hello PIN or smartphone passcode, is generally used to unlock something locally associated with your device.

A conventional website password is a shared authentication secret used with the online service.

This is why using a PIN to approve a passkey does not mean the PIN is being sent to the website. The website receives cryptographic evidence produced by the passkey system.

Protect the device PIN nonetheless. Anyone capable of unlocking your device may have access to sensitive information and credentials available on it.

How to Start Using Passkeys Safely

There is no need to convert every account immediately. Start with one supported account so you can learn how your device handles creation, sign-in, and recovery.

Step 1: Secure your device first

Before adding passkeys, make sure your phone or computer has a screen lock.

Use the security features appropriate to your device:

• iPhone/iPad: passcode plus Face ID or Touch ID where supported.
• Android: screen-lock PIN/password and supported biometric authentication.
• Windows: Windows Hello and a secured Microsoft or local account.
• macOS: a strong login password plus Touch ID where supported.

Install current security updates as well.

A passkey is only one layer; the security of the device holding or accessing it still matters.

Step 2: Decide where your passkeys will live

Your choices may include:

• Apple Passwords/iCloud Keychain
• Google Password Manager
• Microsoft-supported credential systems
• A compatible third-party password manager
• A physical security key

Consider which phones and computers you use.

Someone with an iPhone and Mac may value deep Apple integration. A person using Android, Windows, and multiple browsers may prioritize a credential provider with broad cross-platform support.

Do not choose only on convenience. Understand how the provider synchronizes and recovers passkeys.

Step 3: Pick an account that supports passkeys

Open the service’s official app or navigate directly to its known website.

Look under Security, Sign-In, Login, Passkeys, or Authentication.

Do not follow an unexpected message saying you “must install a passkey.” A legitimate passkey is configured through the service’s official account interface and supported operating-system/browser prompts.

Step 4: Choose “Create a passkey”

When offered, choose the service’s option to create a passkey.

Your browser or operating system should display a system authentication prompt. It may ask where you want to save the passkey if multiple compatible credential providers are installed.

Read the service and operating-system prompts before approving.

Step 5: Authenticate on your device

Confirm your identity with the method your device requests, such as:

• Face ID
• Touch ID
• Fingerprint
• Windows Hello
• Device PIN or passcode

The device or credential manager creates the cryptographic credential and registers its public component with the service.

Step 6: Confirm the new passkey appears in account settings

After enrollment, return to the service’s security settings.

Look for its list of passkeys or sign-in methods. Confirm that the new credential appears and that its description corresponds to your device or credential provider.

If the provider allows naming passkeys, use a useful label such as “Personal phone” or “Security key.”

Step 7: Understand recovery before removing other methods

Do not immediately remove your password, backup authentication factor, recovery email, or other access method.

First determine:

• How will you sign in if your phone is lost?
• Does the passkey synchronize to another device?
• Can you use another registered passkey?
• Does the account have secure recovery options?
• Can you access your credential provider after replacing all your devices?
• Does the service allow multiple passkeys?

Once you understand those answers, you can decide whether to keep or remove older sign-in methods where the provider gives you that choice.

How to Use iPhone Passkeys

Apple supports passkeys across its current device ecosystem.

On an iPhone or iPad, passkeys can be managed through Apple’s Passwords system. The precise interface depends on your operating-system version; current devices include the dedicated Passwords app.

To create an iPhone passkey for a supported service:

1. Open the service’s legitimate website or official app.
2. Sign into your existing account.
3. Open its security or sign-in settings.
4. Select its option to create or add a passkey.
5. When the iPhone displays the system passkey prompt, verify the service and choose to continue.
6. Approve using Face ID, Touch ID, or your device passcode as requested.
7. Return to the account security page and confirm the passkey is registered.

To view saved credentials, open Passwords or search iPhone Settings for “Passwords” if your iOS version organizes the setting differently.

Using an iPhone passkey on another computer

Supported passkey systems may allow cross-device authentication.

For example, you might be signing into a supported website on a Windows computer while the relevant passkey is accessible through your iPhone. The website may offer a cross-device option that displays a QR code. You scan it with your phone and approve the authentication there.

This process uses FIDO mechanisms designed for cross-device authentication and requires proximity checks. Follow only the prompts associated with a login you deliberately initiated.

Do not scan an unexpected passkey QR code sent through email, text, social media, or an unsolicited website.

How to Use Google Passkeys

Google supports passkeys for Google Accounts and through its credential-management ecosystem.

For a personal Google Account:

1. Navigate directly to your Google Account.
2. Open Security or the current sign-in/security settings.
3. Find Passkeys or the relevant “How you sign in to Google” area.
4. Authenticate if Google asks you to confirm your identity.
5. Choose the option to create a passkey.
6. Follow your device’s system prompt.
7. Approve using the local authentication method requested.
8. Return to your Google Account security settings and review the registered passkey.

On Android, passkey creation and management may use Google Password Manager or Android’s current Credential Manager infrastructure. Menu names differ by phone manufacturer and Android release, so search Settings for passkeys, passwords, or credential manager when necessary.

Google Workspace accounts managed by an employer or school may have different options. The organization’s administrator can determine whether certain authentication methods are available.

What About Microsoft Passkeys and Windows?

Microsoft also supports passkey and passwordless authentication across Microsoft accounts and Windows.

On Windows, Windows Hello can use facial recognition, fingerprints, or a PIN to authorize supported authentication.

For a Microsoft account, start at the official Microsoft Account site and review Security or Advanced security options for currently available passkey and sign-in methods.

Windows can also work with passkeys stored by compatible providers or devices. Microsoft’s implementation continues to evolve with Windows releases, so Settings search for passkeys and Microsoft’s current support documentation are preferable to relying on a fixed menu path.

Work or school accounts may be subject to administrator policies.

Can You Use Passkeys Across Apple, Android, and Windows?

Increasingly, yes, but there are important details.

Passkey standards are cross-platform, but where your particular passkey is stored affects where it is directly available. Credential providers differ in synchronization and portability.

Cross-device authentication can also bridge ecosystems. For example, a passkey on a phone may be usable to approve a sign-in on a nearby computer through an operating-system/browser-supported flow.

Third-party password managers may provide another cross-platform option.

Before choosing a primary passkey provider, consider your likely device mix over the next few years—not just the device in your hand today.

Passkeys vs. Password Managers

These technologies are complementary rather than mutually exclusive.

A password manager helps you create, save, and autofill unique passwords. Many modern password managers can also store and use passkeys.

You will probably continue encountering passwords for years because not every website supports passkeys. A password manager therefore remains useful even as passkey adoption grows.

For a new account, your practical sign-in options might include:

Account support	Practical approach
Password only	Generate a unique password with a password manager
Password + 2FA	Use a unique password plus a strong available second factor
Passkey optional	Consider creating a passkey after reviewing recovery
Passwordless passkey	Confirm backup/recovery access before removing older methods
FIDO security key	Useful phishing-resistant option where supported

Are Passkeys a Form of 2FA?

The answer is more nuanced than a simple yes or no.

A passkey can provide multifactor characteristics when its use requires both possession of the authenticator and local user verification, such as a device PIN or biometric. NIST and FIDO terminology distinguishes among different authenticator types and assurance properties.

From a consumer perspective, the important point is that a passkey does not work like “password plus six-digit code.” It is a different authentication architecture.

A service may use a passkey as its primary passwordless sign-in method, as one factor in a larger authentication process, or alongside other account-security options.

What Happens if You Lose Your Phone?

Losing a phone does not necessarily mean losing your passkeys.

If your passkeys were securely synchronized through your credential provider, you may be able to access them from another authorized device or restore access through that ecosystem’s recovery process.

If a credential was device-bound, recovery may require another registered passkey or the service’s normal account-recovery mechanism.

This is why recovery planning matters.

Before depending on passkeys for critical accounts:

1. Understand whether your passkeys sync.
2. Add another trusted device or passkey where appropriate.
3. Keep account recovery information current.
4. Understand your credential provider’s recovery process.
5. Protect the account that synchronizes your credentials.

If your phone is lost or stolen, follow the manufacturer’s official lost-device procedures and review the device list associated with your Apple, Google, or Microsoft account.

What Happens if You Replace Your Phone?

Plan before erasing the old one.

Verify that your passkeys are available through another authorized device or that your credential provider’s supported transfer/synchronization process has completed. Test access to important accounts on the replacement device before wiping the old phone.

After successful migration, remove the old device from relevant account device lists and factory-reset it before selling, recycling, or giving it away.

Do not assume every passkey transfers in exactly the same way. The behavior depends on how and where the credential was stored.

Can a Website Leak Your Passkey?

A service stores your public key, not the private key required to authenticate as you.

Public keys are designed to be public. Possession of the public key alone does not enable someone to derive and use the corresponding private key under the cryptographic assumptions used by these systems.

This differs significantly from passwords. Even properly designed websites need password verifiers that can become targets for offline guessing after certain kinds of data exposure.

Passkeys remove that reusable password-verifier problem from the authentication model.

That does not mean a breach involving a passkey-enabled service could never expose other personal information or session data. Passkeys specifically improve authentication; they do not encrypt every piece of data a company stores about you.

Do Passkeys Have Any Downsides?

Yes. No authentication technology is perfect.

Website support is not universal

Many services still require passwords, and passkey adoption varies.

Recovery can be confusing

Consumers need to understand where credentials are stored and how they can recover access after losing devices.

Multiple ecosystems can create complexity

Someone with an iPhone, Windows PC, Android tablet, and several browsers may encounter different credential-provider prompts.

Account recovery can remain a weak point

A website may provide passkeys but still offer a weaker fallback recovery method. Authentication security is only one part of overall account security.

Unlocked devices still need protection

A passkey does not make physical device security irrelevant. Use a strong screen lock and keep your devices updated.

These limitations are reasons to plan carefully, not reasons to avoid passkeys.

Common Mistakes to Avoid

Do not delete every old login method the moment you create your first passkey. First make sure you know how you would recover the account without your current phone or computer.

Avoid creating passkeys on public or shared devices unless you understand exactly where the credential will be stored and who controls that device.

Do not approve passkey prompts you did not initiate. Passkeys resist credential phishing, but unexpected authentication prompts should still be treated cautiously.

Never scan an unexpected QR code simply because a message says it is needed to “protect” your account. When cross-device authentication uses a QR code, initiate the login yourself on the legitimate service.

Do not confuse biometric authentication with sending biometric data to every website. Face or fingerprint recognition typically unlocks the credential locally.

Do not assume a passkey automatically removes a password. Some services allow both methods until you explicitly change the configuration.

Finally, do not neglect the account protecting your synchronized credentials. If your passkeys are stored through an Apple, Google, Microsoft, or password-manager ecosystem, secure that provider account and its recovery mechanisms carefully.

How to Review and Remove Old Passkeys

Accounts that support passkeys commonly provide a list of registered credentials in their Security or Sign-In settings.

Periodically review that list, particularly after replacing a phone, returning a work computer, losing a device, or changing password managers.

If you see a passkey associated with a device or credential provider you no longer control, follow the service’s official process to remove it.

Removing a passkey from one website does not necessarily remove unrelated passkeys from your credential provider. Likewise, deleting a local credential may not tell the associated website that you intended to revoke it. When retiring a credential, review both the service and credential provider where appropriate.

If You Suspect Unauthorized Account Access

An unfamiliar sign-in does not automatically mean your passkey was defeated. Unauthorized access could involve an existing session, a fallback password, an account recovery method, or another sign-in mechanism.

If you suspect someone accessed an account:

1. Navigate directly to the service’s official app or website.
2. Review recent account and security activity.
3. Sign out unfamiliar sessions where the service provides that control.
4. Review registered passkeys and remove ones you do not recognize.
5. Check passwords, MFA methods, recovery phone numbers, and recovery emails.
6. If email is involved, review forwarding rules, filters, and connected applications.
7. Follow the provider’s official compromised-account or recovery process.

Do not assume that a suspicious login notification proves an account was accessed. Verify the event inside the legitimate account interface.

FAQ

What are passkeys in simple terms?

A passkey is a cryptographic login credential that replaces or supplements a password. You typically approve its use by unlocking your phone or computer with a PIN, passcode, fingerprint, or face recognition.

The private cryptographic key is not sent to the website.

Are passkeys safer than passwords?

Passkeys address several major password weaknesses. They cannot be weak in the traditional sense, cannot be reused like passwords, and are designed to resist conventional credential phishing.

However, overall account security still depends on device security, recovery mechanisms, software, and how the online service is configured.

Can hackers guess a passkey?

Passkeys are not short human-created secrets that can be guessed like passwords. They rely on strong cryptographic private keys.

An attacker might instead target another part of an account’s security, such as a recovery mechanism or an already-authenticated device. That is why passkeys should be part of a broader security approach.

Can someone steal my fingerprint when I use a passkey?

The website does not normally receive your fingerprint or facial data as part of passkey authentication. Biometrics are generally processed locally by the device to authorize use of the cryptographic credential.

Specific biometric implementations depend on the operating system and hardware.

Do I still need two-factor authentication with a passkey?

It depends on how the service implements passkeys. A passkey may satisfy the service’s authentication requirements without a separate one-time code.

Continue using the security configuration recommended by the provider rather than disabling other safeguards simply because you created a passkey.

Do passkeys work without a phone?

Yes. Passkeys can be used through supported computers, credential managers, and hardware security keys; they are not exclusively phone credentials.

Your available options depend on the service, operating system, browser, and credential provider.

Can I use the same passkey for multiple websites?

No in the way people reuse passwords. Each service receives a distinct credential associated with that service.

Your credential manager may hold many passkeys, but the cryptographic credential for one website is not reused as the credential for another.

What if a website stops supporting passkeys?

A service should provide an account-management or recovery path appropriate to its authentication system. Support policies vary.

Keeping recovery information current and understanding a service’s fallback methods reduces the risk of losing access when authentication systems change.

Should I switch all my accounts to passkeys today?

There is no need to rush. Start with a few important services that have mature passkey support, understand how synchronization and recovery work, and expand from there.

Keep unique passwords and strong MFA for services that still require them.

Are Google passkeys different from iPhone passkeys?

They use the same broad FIDO/WebAuthn standards, but the credential may be managed through different ecosystems. Apple, Google, Microsoft, hardware security keys, and compatible password managers can have different synchronization, interface, and recovery behavior.

The underlying goal—secure public-key authentication—is similar.

When to Get Extra Help

Contact the service’s official support or account-recovery channel if you lose access to all devices containing your passkeys, cannot use your credential provider’s recovery mechanism, or see authentication methods you do not recognize.

For Apple, Google, or Microsoft ecosystem issues, navigate directly to the provider’s official support website rather than calling a number supplied in an unexpected popup, email, or text.

If a suspicious account event involves unauthorized financial transactions, contact the relevant bank, credit union, card issuer, or payment provider through an official number or application.

If you suspect personal information is being used for identity theft, US consumers can find official general information and recovery steps at the FTC’s IdentityTheft.gov. This article provides general cybersecurity information, not legal or financial advice.

If a situation involves stalking, domestic abuse, harassment, or an immediate threat to personal safety, changing shared devices or authentication settings can sometimes be visible to another person. Consider specialized safety resources and appropriate local assistance; contact emergency services if there is immediate danger.

Passkey Setup Checklist

Passkeys replace the central weakness of traditional passwords—a reusable secret that people must remember and can accidentally give to the wrong website—with public-key authentication tied to the legitimate service.

You do not need to migrate everything at once. Start carefully:

• Secure your phone or computer with a strong screen lock.
• Decide which trusted credential provider will manage your passkeys.
• Add a passkey to one supported account through its official settings.
• Confirm that the passkey works before changing other login methods.
• Understand whether your passkeys synchronize among devices.
• Plan how you would recover access after losing your primary device.
• Secure the Apple, Google, Microsoft, or password-manager account that manages synchronized credentials.
• Remove obsolete passkeys when you retire devices or credential providers.

For accounts without passkeys, continue using unique passwords stored in a reputable password manager and enable appropriate MFA. Passkeys are an important improvement in consumer authentication, but the most effective transition is one that also preserves safe, reliable account recovery.