If you have noticed websites offering to “create a passkey” when you sign in, you are seeing one of the biggest changes to online security in years. Passkeys are designed to replace passwords entirely, and the largest tech companies, including Google, Apple and Microsoft, now support them across their platforms. They are the latest in a long line of tech ideas that changed how the web works. With passkeys explained in plain terms, it becomes much easier to decide whether to switch.
This guide explains what a passkey actually is, why it is safer than a password, where the catches are, and how to set one up on the accounts that matter most.
Passkeys Explained: What Is a Passkey?
A passkey is a digital credential that lets you sign in without typing a password. Instead, you confirm it is you in the same way you unlock your phone or laptop: with your fingerprint, your face, or your device PIN.
Behind the scenes, a passkey is made of two linked cryptographic keys. One, the public key, is stored by the website. The other, the private key, stays on your device or in your password manager and is never sent to the website. When you sign in, the site sends a challenge that only your private key can answer correctly. Your fingerprint or PIN simply unlocks that private key on your own device.
Passkeys are built on open standards known as FIDO2 and WebAuthn, which is why the same approach works across different brands and browsers. You can read more about the standard on the FIDO Alliance website.
Why Passkeys Are Safer Than Passwords
Most account takeovers happen because passwords are guessed, reused or stolen. Passkeys remove those weaknesses in several ways:
- They cannot be phished. A passkey is tied to the real website’s address. If a scam site copies your bank’s login page, your device simply will not offer the passkey there.
- Nothing useful leaks in a data breach. Websites only store the public key, which is useless to a criminal on its own.
- There is nothing to reuse. Every passkey is unique to one account on one site.
- Two-factor protection is built in. Signing in requires something you have (your device) and something you are or know (your fingerprint, face or PIN).
Passwords vs Passkeys at a Glance
| Password | Passkey | |
|---|---|---|
| How you sign in | Type a memorised string | Fingerprint, face or device PIN |
| Can be phished | Yes | No |
| Exposed in website breaches | Often, if poorly stored | No, only a public key is stored |
| Needs separate two-factor step | Usually | No, it is built in |
| Works on every website | Yes | Only on sites that support it |
Where Are Passkeys Stored?
When you create a passkey, it is saved in a credential manager. The main options are:
- Apple devices: iCloud Keychain, which syncs passkeys across your iPhone, iPad and Mac signed in with the same Apple account.
- Android and Chrome: Google Password Manager, which syncs passkeys across devices signed in to the same Google account.
- Windows: Windows Hello, with Microsoft adding sync through your Microsoft account.
- Third-party password managers: services such as 1Password and Bitwarden can store and sync passkeys across Apple, Android and Windows devices, which is useful if you mix brands.
Because synced passkeys are backed up to your account, losing a phone does not mean losing access, as long as you can still sign in to your Apple, Google or password manager account on a new device.
How to Set Up a Passkey
Google account
- Sign in at myaccount.google.com on a device you own.
- Open the Security section.
- Find Passkeys and security keys and choose to create a passkey.
- Confirm with your fingerprint, face or screen lock.
Google advises creating passkeys only on devices you personally own, because anyone who can unlock that device could use the passkey.
Apple devices
On iPhone, iPad and Mac, passkeys are created when a website or app offers one. Make sure iCloud Keychain is switched on in your Apple account settings so your passkeys sync. When a supported site asks whether to save a passkey, confirm with Face ID or Touch ID. You can view saved passkeys in the Passwords app or in your device’s password settings.
Windows and Microsoft accounts
- Make sure Windows Hello is set up under Settings, Accounts, Sign-in options.
- Sign in to your Microsoft account security settings.
- Choose the option to add a new sign-in method and select a passkey.
- Confirm with your Windows Hello face, fingerprint or PIN.
Menu names change from time to time, so if an option has moved, search your account’s security settings for “passkey”.
Which Accounts Should You Start With?
You do not need to switch everything at once. Prioritise the accounts that would cause the most harm if someone took them over:
- Your main email account, because it can reset almost every other password.
- Your Apple, Google or Microsoft account.
- Banking, PayPal and shopping accounts with saved cards.
- Social media and messaging accounts.
The Catches You Should Know About
- Not every site supports passkeys yet. Large platforms do, but many smaller sites still rely on passwords.
- Moving between ecosystems can be awkward. A passkey saved in iCloud Keychain is not automatically available on a Windows PC, although you can usually sign in by scanning a QR code with your phone. A cross-platform password manager avoids most of this friction.
- Shared devices need care. Anyone who can unlock a device can use the passkeys stored on it.
- Keep a backup sign-in method. Leave a recovery email or phone number on important accounts in case you lose access to your credential manager.
Frequently Asked Questions
Does my fingerprint get sent to the website?
No. Your fingerprint or face scan never leaves your device. It only unlocks the passkey stored locally.
Can I still use my password after creating a passkey?
On most sites, yes. The password usually remains as a backup. Some services, including Google and Microsoft, let you remove the password entirely once you are comfortable.
What happens if I lose my phone?
If your passkeys were synced through iCloud Keychain, Google Password Manager or a password manager, they will be available again when you sign in on a new device. Passkeys stored only on a single hardware security key are lost with that key, so register a backup.
The Bottom Line
Passkeys are one of the simplest security upgrades available. They are quicker than typing a password, cannot be phished, and remove the risk of reused passwords. Start with your email and main tech account, keep a recovery method in place, and add passkeys to other accounts whenever a site offers them. Now that you have passkeys explained, setting up your first one should take only a couple of minutes.
