What Are Passkeys and How Do You Use Them?

You have probably seen the prompt by now. You sign in to Google, Amazon or your bank, and a box pops up asking if you want to “create a passkey.” Most people tap “Not now” because they are not sure what it means or what happens if they lose their phone.

Here is the short version: a passkey is a safer, faster replacement for a password, and it takes about a minute to set up. This guide explains what a passkey is in plain English, how to create one on iPhone, Android and Windows, and how to make sure you never lock yourself out.

What a passkey is, in plain English

A passkey is a digital key that lives on your device instead of in your head. When you create one for a website, your device makes a matching pair of keys. The website keeps one half (the public key), and your phone, computer or password manager keeps the other half (the private key) locked away.

When you sign in, the website asks your device to prove it holds the matching private key. Your device asks you to unlock it with your fingerprint, face scan or PIN, then answers the website’s challenge. Your private key never gets sent over the internet, and there is nothing for you to type.

Passkeys are built on open standards from the FIDO Alliance and the World Wide Web Consortium (W3C), which is why the same idea works across Apple, Google and Microsoft devices. If you want the deeper technical background, our guide to passkeys and the end of passwords covers the cryptography and how businesses are rolling them out.

Is your fingerprint sent to the website?

No. Your fingerprint or face scan only unlocks your own device, the same way it does when you open your phone. Microsoft, for example, states that biometric data used for passkeys stays on your device and is never shared with Microsoft. The website only ever sees proof that your device holds the right key.

Why passkeys are safer than passwords

Passwords fail in predictable ways. People reuse them, pick easy ones, and type them into fake login pages. Passkeys fix all 3 problems at once.

• Nothing to steal in a data breach. The website only stores your public key, which is useless to a thief on its own.
• Nothing to reuse. Each passkey is unique to one website or app.
• Built-in phishing protection. A passkey is tied to the real website’s address. A look-alike scam site cannot ask for it, so even a convincing fake login page gets nothing.

That last point matters most for everyday users. Many account takeovers start with a scam text or email that leads to a fake sign-in page. If you want to sharpen your eye for those, read our guide on how to spot a scam text.

Key takeaway: A passkey cannot be guessed, reused or typed into a fake website. It is the most practical upgrade most people can make to their account security this year.

Passkeys vs passwords vs two-factor codes

Passkeys do not replace every security tool overnight. Here is how they compare with what you probably use today.

If an account does not offer passkeys yet, turning on two-step verification is the next best move. Our walkthrough on how to set up two-factor authentication compares each option.

Synced vs device-bound passkeys

The FIDO Alliance describes 2 kinds of passkeys, and the difference affects recovery.

Synced passkeys are stored in a passkey provider, such as iCloud Keychain, Google Password Manager or a third-party password manager, and copied to all your devices signed in to that account. Most people use these. If you get a new phone and sign in to the same account, your passkeys come back.

Device-bound passkeys never leave one piece of hardware. The classic example is a passkey stored on a FIDO2 hardware security key, which the FIDO Alliance calls the highest-assurance option. They are great for very sensitive accounts but need more planning, because losing the key means losing that passkey.

How to create a passkey on your devices

The exact menus change with software updates, but the pattern is the same everywhere: sign in normally, find the security or sign-in settings, choose “Create a passkey,” and confirm with your screen lock.

On iPhone, iPad and Mac

Apple stores passkeys in iCloud Keychain so they sync across your Apple devices.

1. Make sure iCloud Keychain is turned on in your Apple Account settings.
2. Visit a website or app that supports passkeys and look for “Create a passkey” or “Sign in with a passkey” in the account or security settings.
3. Confirm with Face ID, Touch ID or your passcode when prompted.

On iOS 18 and later, you can view and manage saved passkeys in Apple’s Passwords app. Open it, unlock it with Face ID, Touch ID or your passcode, then pick a website to see its passkey. On iOS 17 and earlier, saved passkeys live under Settings, then Passwords.

On Android and Chrome

Google stores passkeys in Google Password Manager by default and syncs them to other devices where you use Chrome signed in to the same Google Account.

For your Google Account itself, Google’s help center says to go to myaccount.google.com/signinoptions/passkeys, tap Create a passkey, and confirm with your screen lock. Google lists support for Android 9 or later, iOS 16 or later, Windows 10 or later, macOS Ventura or later and ChromeOS 109 or later, along with recent versions of Chrome, Safari, Edge and Firefox. You need a screen lock turned on.

On Windows

Microsoft lets you add a passkey to a Microsoft account from its Advanced Security Options page by choosing to add a new way to sign in and selecting face, fingerprint, PIN or security key. Microsoft also notes that if you already sign in to Windows 11 with a Microsoft account, a passkey for that account has been created for you, and you can see it under Settings, Accounts, Passkeys.

Using your phone to sign in on another computer

What if you are on a library computer or a friend’s laptop with no passkey saved? Choose the option to use a passkey from another device. The site shows a QR code. Scan it with your phone, and the 2 devices confirm they are physically near each other over Bluetooth before you approve the sign-in on your phone. Both devices need Bluetooth on and an internet connection.

How to recover access if you lose your phone

This is the question that stops most people, so here is the reassuring part: losing a phone rarely means losing your accounts, as long as you prepare a little.

1. Synced passkeys come back automatically. Set up your new device and sign in to the same Apple Account, Google Account or password manager, and your synced passkeys reappear. Apple says iCloud Keychain can be recovered even if you lose all your devices, using your Apple Account password, a verification code sent to your trusted phone number and the passcode of a previous device.
2. Remove the lost device. Google advises signing in on a device you still have and removing the passkey tied to the lost or stolen device. Do the same for any other important account.
3. Keep a second way in. Most sites still let you use a password or a recovery method alongside your passkey. Google, for example, does not delete your password when you add a passkey.
4. Consider a backup key for critical accounts. The FIDO Alliance notes that a hardware security key can act as a recovery credential if you lose every device with synced passkeys.
5. Fall back to account recovery. If all else fails, the website’s normal account recovery process still applies.

Moving to a new phone soon? Our guide on how to transfer data to a new phone covers the rest of the switch.

Common worries, answered

“What if someone steals my phone?” They would also need to unlock it. That is why your screen lock matters more than ever. Use a strong PIN or passcode, not a 4-digit birthday, and turn on any stolen-device protection your phone offers. Only create passkeys on devices you personally own, since anyone who can unlock the device can use them.

“Can I share a passkey with my spouse?” Some providers allow it. Apple’s Passwords app supports shared groups for passwords and passkeys with trusted contacts. Otherwise, each person can create their own passkey on their own device for a shared account, if the site allows multiple passkeys.

“Do I have to use Apple or Google?” No. Many third-party password managers can store and sync passkeys across platforms, which helps households that mix iPhone, Android and Windows.

“What happens to my password?” On most sites it stays as a backup for now. Some services let you remove it later once you trust your passkey setup.

Where to start: a 20-minute passkey plan

You do not need to convert every account today. Start with the ones that would hurt most if someone broke in.

1. Turn on a strong screen lock on your phone and computer (5 minutes).
2. Pick your passkey home. Use iCloud Keychain, Google Password Manager or your password manager, and stick with one if you can.
3. Create a passkey for your email account first (5 minutes). Your email is the key to resetting everything else.
4. Add passkeys to your bank, shopping and social media accounts when they prompt you, or from their security settings (10 minutes).
5. Write down your recovery plan. Note which provider holds your passkeys and keep your Apple Account or Google Account recovery details up to date.

Setting up devices for an older relative? Passkeys can be easier for them than passwords. See our tips on how to set up a phone for a senior.

Conclusion

Passkeys trade the password you have to remember for a key your device keeps safe, unlocked by the same face, fingerprint or PIN you already use dozens of times a day. They are quicker to use, cannot be phished, and recovery is straightforward when you use a synced provider and keep your recovery details current. Start with your email account this week, then add passkeys to the rest of your accounts as they ask.

Sources

• FIDO Alliance: Passkeys — definition, synced vs device-bound passkeys, cross-device sign-in and recovery options
• Google Account Help: Sign in with a passkey instead of a password — creating, removing and device requirements for Google Account passkeys
• Apple Platform Security: Passkeys and iCloud Keychain recovery — iCloud Keychain recovery steps
• Apple Support: Find saved passwords and passkeys on your iPhone — viewing and managing passkeys in the Passwords app
• Microsoft Support: Signing in with a passkey — adding a passkey to a Microsoft account, Windows 11 passkeys and biometric privacy
• Google for Developers: Passkey support on Android and Chrome — how Google Password Manager stores and syncs passkeys