What a passkey is
A passkey is a way of signing in without typing a secret that you have to remember. Instead of a password, your device holds a cryptographic key that proves it is you. When you create a passkey for a site, your device makes a pair of linked keys. The site keeps one half, called the public key. Your device keeps the other half, the private key, and never sends it anywhere.
When you sign in, the site sends a challenge. Your device signs that challenge with the private key, and the site checks the result against the public key it stored. You approve the step by unlocking your device, usually with a fingerprint, face scan or screen lock PIN. The biometric or PIN is normally checked on the device itself and is not sent to the website.
Why this is different from a password
A password is a shared secret: you know it, and the site checks it. That means it can be guessed, reused, leaked from a database or typed into a fake page. Passkeys remove several of these weaknesses.
- Nothing reusable is stored on the site. A site holds only a public key. If its database is stolen, the public keys are not useful for signing in elsewhere. This changes the impact of data breaches considerably, although it does not remove every risk.
- Nothing to guess or reuse. There is no short phrase for an attacker to try across many sites.
- Resistant to fake sites. A passkey is tied to the real website address it was created for. If you land on one of the lookalike domains that scammers register, your device will not offer the passkey, because the address does not match. This is why passkeys are described as resistant to phishing, which is one of their main practical advantages, particularly against phishing emails that link to convincing fake login pages.
None of this makes them magic. They protect the sign-in step, not everything else about your account.
What passkeys depend on
Your device and its lock
The private key lives on a phone, computer or hardware security key, protected by the device’s unlock method. If your screen lock is weak or someone knows your PIN and has your phone, the protection is weaker. A decent screen lock matters more once passkeys are in use.
Syncing between devices
Many platforms can sync passkeys through an account, such as the system’s built-in keychain or a compatible password manager, so that a passkey made on your phone also works on your laptop. This is convenient, but it means your passkeys are only as secure as the account that syncs them. Some people prefer a passkey that stays on one device or on a physical key. Support for each approach varies by system and by site, so it is worth checking how your own setup behaves.
Support from the site
A passkey only works where the service has added support. Adoption has been growing, but many sites still offer only passwords, so for the foreseeable future you will likely use both.
A recovery route
If you lose your only device, you need another way back in. That might be another device that holds the passkey, a recovery code, or a fallback method supplied by the service. It is sensible to understand the recovery route before relying on a passkey for something important. Recovery is also an area attackers target, so a service’s fallback can be a weak link.
Using one in practice
Creating a passkey typically involves going into the security settings of an account and choosing an option to add or create a passkey. After that, the sign-in screen offers it, and you confirm with your fingerprint, face or PIN. On a computer without the passkey, many systems let you scan a code with your phone to approve the sign-in.
Passkeys often replace both the password and the second step, because the device unlock covers “something you have” and “something you are or know”. Where a site still uses a password, two-factor authentication remains a good addition.
Passkeys and password managers
A password manager and passkeys are not rivals. Several password managers can now store and fill passkeys alongside ordinary logins, which can help when you use different kinds of devices. For sites that do not yet support passkeys, a unique password from a manager remains the better habit.
Limits and honest caveats
- Not every site or app supports passkeys, and the experience differs between them.
- Moving passkeys between different ecosystems has been awkward in some cases, though this is improving.
- If someone controls your unlocked device, or the account that syncs your passkeys, they may reach what the passkeys protect.
- Malware on a device, or a scam that persuades you to approve a sign-in or hand over a recovery code, can still cause harm.
Passkeys do not replace sensible caution. A phone call asking you to approve a prompt you did not start is still a warning sign.
Should you switch?
For most people, turning on passkeys for important accounts such as email, a main shopping account or a financial service, where available, is a reasonable step that reduces exposure to phishing and reused passwords. Keep a recovery option set up first, keep the device itself locked and its software updates installed, and expect to use passwords for some time yet. It is a gradual change rather than an overnight end to passwords.