Passkeys explained: the login that can't be phished
Passkeys replace passwords with something you can't accidentally give away. They're faster, they can't be reused across sites, and a fake login page can't steal them. Here's what they are and how to start.
Passwords have a built-in flaw: anything you can type, you can be tricked into typing somewhere else. Passkeys fix that. They're already built into iPhones, Android phones, Windows, Macs, and every major browser — and for most people they're the single biggest security upgrade available today.
What a passkey actually is
A passkey is a secure digital key stored on your device and unlocked by your face, fingerprint, or screen PIN. When you sign in, your device proves who you are to the website without ever sending a secret the site — or anyone watching — could reuse. There's nothing to remember and nothing to type.
Why passkeys beat passwords
- They can't be phished. A passkey is tied to the real website's address. On a lookalike phishing page it simply won't work — there's no password box to fill in by mistake.
- They can't be reused or guessed. Every passkey is unique to one site, so a breach of one service can't unlock another.
- There's nothing to steal in a breach. Sites store only the public half of the key, which is useless on its own. The secret half never leaves your device.
- They're faster. A glance or a touch, and you're in — no typing, no codes.
How it works, in plain terms
When you create a passkey, your device makes a matched pair of keys. The public key goes to the website; the private key stays locked on your device and never leaves it. To sign in, the site sends a challenge, your device answers it using the private key (after you unlock with face, fingerprint, or PIN), and the site checks the answer against the public key. The secret is never transmitted, so there's nothing for an attacker to intercept or trick out of you.
Setting up your first passkey
Pick an important account that already offers passkeys — your email, Google, Microsoft, or Apple account is a great start. Look in its security settings for "Passkeys" or "Sign in with a passkey," then follow the prompt. The setup takes seconds:
- iPhone/iPad: passkeys save to your iCloud Keychain and sync across your Apple devices automatically.
- Android: passkeys save to your Google Password Manager and sync across your Android devices.
- Windows: passkeys can be stored with Windows Hello (face, fingerprint, or PIN) on your PC.
- A password manager: many password managers now store passkeys too, which syncs them across phones, tablets, and computers regardless of brand.
Deciding where to keep them? See our two-factor and passkey tools directory for trusted options.
What happens if you lose your device?
This is the question everyone asks — and the answer is reassuring. Passkeys are designed to be recoverable:
- If they sync through iCloud, Google, or a password manager, they restore automatically when you sign in to your new device.
- Most accounts let you register more than one passkey — add one on your phone and one on your laptop so losing either doesn't lock you out.
- Services keep a backup sign-in method (and recovery codes) in case you ever need it.
Save your account's recovery codes somewhere safe offline, and you have a reliable safety net.
Common worries, answered
Does the website get my fingerprint or face? No. Your biometrics never leave your device; they only unlock the key locally. The site only ever sees the cryptographic answer.
Can I still use a password too? Usually yes — most sites keep the password as a fallback while passkeys roll out. Once you're comfortable, you can often remove weaker options.
What if I use someone else's computer? You can sign in by scanning a QR code with your phone, which holds the passkey. The phone approves the login; the borrowed computer never gets the key.
Are passkeys the same as a password manager? Not quite — but they work beautifully together. A password manager can store and sync your passkeys, giving you one secure home for your logins.
Passkeys vs. authenticator apps vs. hardware keys
- Passkeys replace the password entirely and resist phishing by design. Best default for most accounts.
- Authenticator apps (the 6-digit codes) are a strong second factor on top of a password — better than SMS, but the code can still be phished if you type it into a fake page.
- Hardware security keys (like a YubiKey) are a physical form of the same phishing-resistant technology — excellent for high-risk accounts.
Where to start today
Add a passkey to your primary email first — it's the account that protects all the others. Then add passkeys to your most valuable logins as each service offers them. You don't have to switch everything at once; every passkey you add is one more login that can't be phished. For a wider plan to harden your accounts against modern, AI-assisted attacks, see our guide on protecting your accounts from AI-driven cyberattacks.