Passwords are the weak spot in most people’s online lives. They get reused, guessed, leaked in data breaches and typed into convincing fake login pages. Passkeys are designed to replace them: instead of typing a secret, you confirm it is you with the same fingerprint, face scan or PIN you already use to get into your phone or computer.
This guide explains what a passkey is in plain terms, why it is harder to steal, where your passkeys are stored and how to set up your first one on iPhone, Android or a computer. It also covers the catches, because passkeys are not yet a complete replacement for every password you have.
What a passkey actually is
A passkey is a pair of matching digital keys created when you add one to an account. One half, the public key, is stored by the website or app. The other half, the private key, stays with you, inside your device or your password manager. When you sign in, the site sends a challenge that only your private key can answer, and your device answers it after you confirm with your fingerprint, face or PIN.
Two details matter. First, your fingerprint or face scan never leaves your device; it only proves to your phone that you are you, and the phone then does the cryptographic work. Second, the private key is never sent to the website, so there is no secret sitting on the company’s servers for hackers to steal. Passkeys are built on open standards backed by the FIDO Alliance, an industry group, which is why they work across Apple, Google and Microsoft systems.
Why passkeys are harder to steal
With a password, anyone who learns the secret can use it from anywhere in the world. A passkey closes off most of the usual ways that happens:
- Phishing: a passkey is tied to the real website’s address, so your device will not offer it on a lookalike site. Even a very convincing fake login page has nothing to collect.
- Data breaches: the site only holds your public key, which is useless on its own.
- Reuse: every passkey is unique to one account, so one leak cannot spread to your other accounts.
- Guessing: there is nothing short or memorable to guess.
Passkeys do not protect you from everything. Someone who has your phone and knows its PIN can still use it, so a strong screen lock matters more than ever. Many accounts also keep a password or a text-message code as a backup way in, and attackers can still target those.
Where your passkeys live
Most people store passkeys in a password manager that syncs them across devices, so a passkey made on your phone also works on your laptop. These are the main options:
- Apple devices: passkeys are saved to iCloud Keychain and appear in Apple’s Passwords app, syncing across an iPhone, iPad and Mac signed in to the same Apple Account.
- Android and Chrome: passkeys are saved to Google Password Manager and sync to devices signed in to the same Google account.
- Third-party password managers: several well-known managers, such as 1Password, Bitwarden and Dashlane, can store passkeys and work across Apple, Android and Windows.
- Hardware security keys: small USB or NFC keys can hold passkeys too. They do not sync, which some people prefer for security, but it means you need a backup key.
If all your devices come from one company, the built-in option is the simplest. If you mix an iPhone with a Windows laptop, or an Android phone with a Mac, a cross-platform password manager can save you some friction. You can also sign in on a computer that holds no passkey by scanning a QR code with your phone, which then confirms the sign-in over Bluetooth; that is why the phone needs to be physically nearby.
How to set up your first passkey
Start with one important account, ideally your main email, since it is the key to resetting almost everything else. Many large services, including Google, Microsoft, Amazon and PayPal, support passkeys, though their menus change from time to time. The steps usually look like this:
- Update your phone or computer to the latest software, and make sure it has a screen lock (PIN, fingerprint or face).
- Sign in to the account the usual way and open its security or sign-in settings.
- Look for an option called “passkeys”, “create a passkey” or “sign in without a password”.
- Follow the prompt and confirm with your fingerprint, face or device PIN. Choose where to save the passkey if asked.
- Sign out, then sign back in with the passkey to make sure it works on each device you use.
Many websites will also offer to create a passkey right after you sign in with a password. If you reached the site by typing its address or using your own bookmark, it is fine to accept. Be wary of any email or text that pushes you to “verify” an account through a link; legitimate services let you set up passkeys inside your account settings, not through urgent messages.
That habit of going to the site directly helps everywhere online. The same instincts that keep you away from fake login pages also help when you are telling a legitimate survey site from a time-waster, where a request for your bank login is an immediate red flag.
What happens if you lose your phone
This is the most common worry, and the answer depends on where your passkeys are stored. If they sync through iCloud Keychain, Google Password Manager or a third-party manager, they come back when you sign in to that account on a new device. That makes the account behind your password manager the most important one you own, so give it a strong, unique password, two-step verification and up-to-date recovery options.
For extra safety, register passkeys on more than one device where a site allows it, and keep any recovery codes a service gives you somewhere safe and offline. Do not remove your old password or backup sign-in method until you have used passkeys comfortably for a few weeks.
The catches to know about
Passkeys are still being rolled out, so expect a mixed picture for a while. These are the snags you are most likely to hit:
- Not every site supports them, and some only allow passkeys on certain devices or browsers.
- Moving passkeys between password managers has been awkward. An industry standard for exporting and importing them is being adopted, but support varies.
- Shared accounts are harder to handle, since a passkey is meant for one person’s device. Some password managers let you share passkeys with trusted people.
- Older phones and computers may not support passkeys at all.
None of these are reasons to wait. On most services, adding a passkey does not remove your existing sign-in options, so you can try it on one account with little risk and add more as you go.
Quick checklist
Work through one account at a time rather than trying to switch everything in one evening. A short session during your Sunday reset is enough to add a passkey or two each week.
- Set a strong screen lock on your phone and computer.
- Protect the account that holds your passkeys (Apple, Google or your password manager) with two-step verification.
- Add a passkey to your main email first, then to banking, shopping and social accounts that support them.
- Test each passkey on every device you use.
- Keep recovery codes offline, and keep your old sign-in method until you are confident.
- Never create or “verify” a passkey from a link in an unexpected email or text.
Passkeys will not replace every password overnight, but each account you switch is one less secret that can be phished, guessed or leaked. For more step-by-step guides to the devices you use every day, browse our tech section.
