What is a passkey, and how do you use one?
A passkey is a sign-in credential that replaces your password. Instead of typing what you remember, you sign in with the same face scan, fingerprint or PIN you use to open your phone or computer, while your device handles a pair of cryptographic keys for that account.
The short version
- A passkey is a pair of keys: the website keeps a public key and your device keeps the private key.
- You approve each sign-in with the same face scan, fingerprint, PIN or pattern you use to open your device.
- Google says a passkey works only on the website or app that created it, and the FIDO Alliance calls passkeys phishing-resistant.
- Synced passkeys are stored in a password manager such as iCloud Keychain or Google Password Manager, so a new phone doesn’t mean starting over.
- To use one, look for a “Create a passkey” option in an account’s security settings, or accept the prompt when a site offers one.
What is a passkey, in plain terms
A passkey is a login built on FIDO standards, which were developed by the FIDO Alliance. The FIDO Alliance describes passkeys as credentials “tied to a user’s account on a website or application” that replace passwords “with cryptographic key pairs.”
In practice, you never see or type a passkey. When you create one, your phone, computer or password manager stores it for that account. Next time you sign in, your device asks you to confirm it’s you with your face, fingerprint, PIN or pattern, and the sign-in completes.
Apple (iPhone), Google (Google Account) and Microsoft (Windows) all support passkeys. Not every website does. If you don’t see a passkey option, Apple notes, the website or app doesn’t currently support passkeys.
How does a passkey work?
When you create a passkey, your device generates two matching keys. According to Google’s developer documentation, “only the public key is stored by the site, but this alone is useless to an attacker.” The private key stays with you, on your device or in your password manager.
Apple explains that the private key is needed to sign in, and that the server never learns it. When you sign in, your device asks for your fingerprint, face or PIN before it uses the private key on your behalf.
Two details matter for security:
- Your biometrics stay on your device. The FIDO Alliance says biometric information “is never sent to any remote server,” and Microsoft says biometric data “is never shared with Microsoft.” The fingerprint or face scan is checked on your device.
- Each passkey is tied to one site. Google says “the browser and operating system ensure that a passkey can only be used with the website or app that created them.” Your device won’t offer your passkey to a fake login page on a lookalike domain.
The FIDO Alliance says the standards behind this are commonly known as FIDO2, made up of WebAuthn and CTAP.
Passkey vs password
Here’s how the two compare, based on what Google, Apple, Microsoft and the FIDO Alliance say:
| Password | Passkey | |
|---|---|---|
| What you do | Remember and type it | Confirm with face, fingerprint or PIN |
| What a data breach exposes | The password data the site stored | Only a public key, which Google says is useless to an attacker |
| Phishing | Can be phished | Phishing-resistant: works only on the site that created it |
| Unique to each site | Only if you make it so | Yes: Microsoft says passkeys are unique to each website or app |
| Strength | Up to you | Always strong, says the FIDO Alliance |
Creating a passkey doesn’t mean giving up your password. Apple says you can keep a passkey and a password for the same account, and Google lets you keep signing in with your password even after you create a passkey.
Synced vs device-bound passkeys
The FIDO Alliance describes two kinds of passkeys:
- Synced passkeys are copied between your own devices through a cloud service. The FIDO Alliance names iCloud Keychain, Google Password Manager, 1Password and Dashlane as examples, and Microsoft adds its own Microsoft Password Manager. The FIDO Alliance says this syncing is end-to-end encrypted.
- Device-bound passkeys never leave the device they were created on, such as a hardware security key. The FIDO Alliance says device-bound passkeys in modern security keys offer the highest security assurance.
Synced passkeys make a lost or replaced phone easier to handle. Google says synced passkeys let you “switch to a new device and immediately use it without needing to re-enroll.”
How to set up a passkey
The exact wording varies by site, but the steps are usually similar: sign in the usual way, open the account’s security settings and choose to create a passkey. Here’s how it works on Google, iPhone and Windows.
Google Account
Google lists these minimums: Windows 10, macOS Ventura or ChromeOS 109 on computers; Android 9 or iOS 16 on phones; and Chrome 109, Safari 16, Edge 109 or Firefox 122. If you’re picking a browser for an older PC, see our guide to the best browser for a low-end PC. Turn on your phone’s screen lock first, and on Apple devices turn on iCloud Keychain.
- Go to myaccount.google.com/signinoptions/passkeys.
- Tap Create a passkey, then tap Create a passkey again.
- Confirm with your device’s screen lock when asked.
Google advises against creating a passkey on a shared device.
iPhone
Apple requires iCloud Keychain and two-factor authentication to be turned on. On a website or app that supports passkeys, sign in with your password, go to the account settings screen and tap Continue when you see the option to save a passkey. The passkey is stored in the Passwords app and synced through iCloud Keychain, where Apple says it isn’t visible to anyone, including Apple. To sign in later, you confirm with Face ID, Touch ID or your device passcode.
Windows 11
When a site offers a passkey, you may see a Create a passkey? prompt, and you confirm with Windows Hello using your PIN, fingerprint or face. To see the passkeys saved on your PC, open Settings > Accounts > Passkeys. Passkeys for a Microsoft account are managed on its security page at account.live.com/proofs/manage.
How to sign in on someone else’s computer
You can use a passkey saved on your phone to sign in on a computer that doesn’t have it, such as a library PC. Google describes the steps for a Google Account:
- Enter your username on the computer’s sign-in page.
- Click Try another way, then Use your passkey. A QR code appears.
- Scan the code with your phone’s camera. Bluetooth must be on.
- On your phone, tap Use passkey to sign in (on iPhone or iPad, Sign in with a passkey) and confirm with your fingerprint, face or PIN.
The FIDO Alliance says Bluetooth is used to verify that your phone is physically near the computer, but the sign-in doesn’t depend on Bluetooth’s security.
What if you lose your phone?
If your passkeys are synced, they’re still in your password manager, and you can use them on a new device once you sign in to that password manager. Apple says iCloud Keychain can recover passkeys even if all your devices are lost.
If a device with a passkey is lost or stolen, Google recommends removing that passkey from your Google Account. Sign in to your Google Account from a device you can still use, open Security & sign-in, choose Passkeys and security keys under “How you sign in to Google,” select the passkey and tap Remove. For a Microsoft account, passkeys are listed on its security page at account.live.com/proofs/manage, and Microsoft notes that once you remove one there, you can no longer use it to sign in.
Deleting a passkey you no longer need
On iPhone, open the Passwords app, tap Passkeys, choose the account, tap Edit, then Delete and Delete Passkey. Apple says you can create a new one at any time. On Windows 11, device-bound passkeys saved on the PC you’re using are deleted in Settings > Accounts > Passkeys: select the ... menu next to the passkey and choose Delete passkey. Microsoft says synced passkeys are managed in the password manager that holds them.
Keeping your devices secure matters more once they hold your sign-ins. If you’re still on an older PC, our guide to whether Microsoft Defender is enough covers the basics.
Frequently asked questions
Is a passkey the same as two-factor authentication?
In effect, yes. Microsoft says “passkeys are considered a form of multi-factor authentication,” because you need your device and your PIN, fingerprint or face. Signing in with a passkey doesn’t add a second step: Google says it bypasses the second step of 2-Step Verification because it verifies that you own the device. The FIDO Alliance notes that some regulations don’t yet formally recognize passkeys as multifactor authentication. Google says passkeys can replace SMS or app-based codes at sign-in.
Can a passkey be hacked or stolen?
A website breach doesn’t expose your private key, since the site only stores the public key. Your device also won’t use a passkey on a phishing site. The weak point is the device or password manager that holds your passkeys, so protect it with a strong screen lock.
Can passkeys be shared?
It depends on the service. Google says passkeys for a Google Account “can’t be shared, copied, written down, or accidentally given to someone else.” Apple’s iPhone guide says you might need to create a new passkey if you previously shared one with someone you no longer want to give access to.
Do passkeys work across devices?
Yes. Synced passkeys follow your password manager account across your devices, and a QR code lets you use your phone’s passkey on a nearby computer. Apple says passkeys work across all your Apple devices signed in to the same Apple Account.
Can I still use my password?
Usually, yes. Google keeps password sign-in available and lets you make it the default by turning off Skip password when possible under “How you sign in to Google.” If you then sign in with a password and 2-Step Verification, Google says any of your passkeys can serve as the second step.