The short version: a passkey lets you sign in with your fingerprint, face or phone lock instead of a typed password. The UK National Cyber Security Centre (NCSC) says to use passkeys where a service offers them.
Why people are moving away from passwords
Passwords are hard to remember and easy to give away. A criminal can trick you into typing one on a fake website, or steal it from a company’s data. Passkeys are a newer way to sign in.
What a passkey is
A passkey is a sign-in method that replaces your password. Apple and the FIDO Alliance (the industry group behind the standard) describe how it works. This is a simplified picture.
When you create a passkey, your device makes a pair of digital keys for that one site. Think of a lock and a key. The site keeps the lock. This is the public key, and it is not a secret. Your device keeps the key. This is the private key, and the site never sees it.
To use the key, you unlock your device as usual. That could be a fingerprint, your face, or your screen PIN. Google says your fingerprint or face data stays on your device and is never shared with Google. Biometrics means using your body, such as a fingerprint, to prove who you are.
Why it is safer
- Nothing to type. You have no password to type on a fake site.
- It works only for the real site. Your device ties each passkey to the real service. This is why passkeys resist phishing. Phishing is a trick message that gets you to give away a password or code.
- Less to steal. The site keeps the public key, which is not a secret. FIDO says that a breach of a site’s password list no longer matters, because there are no passwords on it. See data breach.
- Always strong. You never make up or reuse a password.
Passkeys do not solve everything. You still depend on your device and the account that protects your passkeys. FIDO says a passkey stored on a physical security key gives the highest security assurance, and that syncing (automatic copying) between devices is end-to-end encrypted (locked so the company storing it cannot read it). The key point is how well the account that syncs your passkeys is protected.
Where passkeys live
A passkey is saved in a credential manager. That is the part of your device or account that stores passkeys. Often it is built into your phone or computer, such as Apple Passwords (iCloud Keychain), Google Password Manager or Microsoft Password Manager. Some password managers store passkeys too.
Many credential managers sync passkeys to your other devices. Apple says iCloud Keychain is end-to-end encrypted. That means your passkeys are locked with a key made from your device and your passcode, so Apple cannot read them. A credential manager also makes a backup, so you should not completely lose your passkeys if you lose a device. A passkey saved only on one security key, or one device, does not sync. Apple says iCloud Keychain must be on, and two-factor authentication must be on for your Apple Account. Google says you need at least Android 9, iOS 16, Windows 10 or macOS Ventura, an up-to-date browser, and a screen lock on your phone.
How to create one (Google Account example)
Checked on Google’s help page in Oct 2026.
- On a phone or computer you own, go to myaccount.google.com/signinoptions/passkeys.
- Sign in if Google asks.
- Choose Create a passkey and follow the steps on screen. The button names may differ on your device.
- Next time, sign in and choose the passkey when it is offered.
Google says to create passkeys only on devices you personally own, because anyone who can unlock that device can reach your account. Do not create one on a shared computer. Google also says a new passkey may take up to 7 days to be available at sign-in.
For a Microsoft personal account, Microsoft’s page says to go to account.live.com/proofs/manage and choose Add a new way to sign in or verify.
Sign in on someone else’s device
Google describes how to use the passkey on your phone to sign in on a computer that is not yours:
- On the computer’s sign-in page, choose Try another way, then use your passkey.
- A QR code (a square pattern your camera can read) shows on the screen. Scan it with your phone camera.
- Confirm with your fingerprint, face or PIN on your phone.
Google says to turn on Bluetooth for this. Do this only on a computer you trust, and sign out when you are done.
If you lose your phone
There is no need to worry. If your passkeys sync, they are also on your other devices or in your account. For a Google Account, remove the passkey of the lost device, or sign that device out. Then follow your provider’s steps. Keep your recovery options and backup codes up to date. Google says adding a passkey does not remove your other recovery options.
Honest limits
- Not every website offers passkeys yet.
- Where a site has no passkey, use a strong password from a password manager, plus a second step (an extra check after your password, such as a code from an app). See two-factor authentication.
- Some work or school accounts only allow passkeys as a second step. Your school or employer decides. Its administrator (the person who runs those accounts) sets the rules.
Passkeys or an authenticator app?
Use passkeys where a service supports them, and use two-step verification (an extra check after your password) where it does not. So choose a passkey first. An authenticator app is the next best choice. Text message codes are a last choice. Read why text message codes are weaker. Start with your email account.
Related words: passkey, two-factor authentication (2FA).
Do this today (about 8 minutes)
- Open the security settings of your Google or Microsoft account.
- Create a passkey on a device you own. On an iPhone or Mac, save a passkey the next time a website or app offers one. Apple says iCloud Keychain must be on.
Another day: the next time you sign in, choose the passkey. Google can take up to 7 days before it offers a new passkey. If it is not offered, sign in your usual way and try again later.
Never type a code or password into this website, and never read a code out to someone who contacts you.
Checked: 25 Oct 2026. The worked example uses a Google Account. Settings screens change. If yours looks different, search the company's help page.
