Passkeys are a newer way to sign in that can replace passwords on supported websites and apps. Instead of typing a password, you confirm with your device’s fingerprint, face recognition, PIN or a security key. Major technology companies and many websites support them, and adoption continues to grow.
This guide explains how passkeys work, why they are considered more secure than passwords and how to start using them.
How Passkeys Work
Passkeys use public key cryptography. When you create a passkey for a site, your device generates a pair of keys:
- A private key that stays on your device or in your password manager
- A public key that the website stores
When you sign in, the site sends a challenge, your device signs it with the private key after you unlock with biometrics or a PIN and the site verifies the signature with the public key. Your private key is not sent to the website.
Why Passkeys Are More Secure
Phishing Resistance
A passkey is tied to the specific website it was created for. A lookalike phishing site cannot use it, because your device will not offer it there. This is a major advantage over passwords and many forms of two-factor codes.
Nothing to Steal from the Server
Since websites store only public keys, a breach of the site’s database does not expose anything attackers can use to log in as you.
No Reuse
Each passkey is unique to a site, so there is no reuse problem.
Syncing Across Devices
Many passkeys sync through your phone or computer’s ecosystem or a password manager, so a passkey created on your phone can be available on your laptop. Some passkeys, such as those on hardware security keys, are device-bound and do not sync.
Signing In on Another Device
Many systems let you sign in on a nearby computer by scanning a QR code with your phone, which then confirms the login using its passkey.
How to Set Up a Passkey
- Sign in to an account that supports passkeys
- Go to security settings
- Choose to create a passkey
- Confirm with your device’s biometric or PIN
- Choose where to save it, such as your device ecosystem or password manager
- Test signing in
Passkeys and Password Managers
Many password managers can store and sync passkeys across platforms. See the password manager guide.
Recovery Planning
If you lose a device, synced passkeys remain available on your other devices or in your password manager. Make sure the account that syncs your passkeys has strong protection and recovery options. Keep alternative sign-in methods or recovery codes for important accounts.
Limitations
- Not every site supports passkeys yet
- Moving passkeys between ecosystems can be harder than moving passwords, though export options are improving
- Some sites still keep a password as a fallback, which can still be phished
- Shared family devices can complicate who has access
Should You Switch?
For accounts that support them, passkeys are a strong option. Start with major accounts such as email, and keep backup methods in place. See two-factor authentication setup.
Common Mistakes
- Creating passkeys without understanding where they are stored
- Not protecting the sync account
- Removing all recovery options
A Note on Shared Devices
Passkeys tied to a shared tablet or computer may be usable by anyone who can unlock that device. If family members share a device, consider separate user profiles or keep passkeys for sensitive accounts on personal devices. Use a strong device PIN or password, since that unlock step protects your passkeys.
A Note on Hardware Security Keys
Hardware security keys can store passkeys that never leave the key. They are often used for high-value accounts, such as email administrators or business accounts. Register more than one key and store the backup safely, because a device-bound passkey cannot be recovered if the key is lost.
Comparison Table
| Login method | Phishing resistance | Convenience | Reuse risk |
|---|---|---|---|
| Password only | Low | Moderate | High |
| Password and SMS code | Moderate | Moderate | High |
| Password and authenticator | Moderate | Moderate | High |
| Security key | High | Moderate | None |
| Passkey | High | High | None |
Starting Small
Create a passkey for one account you use often, such as your main email, and see how signing in feels across your devices.
Questions to Ask Before Switching
- Where will my passkeys be stored?
- Can I reach them on every device I use, including work devices?
- What happens if I switch phone brands?
- Does this account still allow a password fallback, and is that password strong?
- What recovery options does this account offer?
A Note on Workplace Accounts
Employers may manage passkeys or security keys for work accounts through their own policies. Follow your IT team’s guidance and do not store work passkeys in personal accounts unless allowed.
Final Passkey Checklist
- Passkey created for main email
- Storage location understood
- Sync account protected
- Recovery codes saved
- Fallback password strong and unique
A Note on Terminology
You may see passkeys described with terms such as FIDO2 or WebAuthn. These are the underlying standards that make passkeys work across devices and websites.
Frequently Asked Questions
Do passkeys replace passwords completely?
On some sites they can; others keep passwords as a fallback.
Are passkeys safe if my phone is stolen?
The thief would still need to unlock the device. Use a strong device PIN.
Can I use passkeys on multiple devices?
Synced passkeys can be available across your devices.
Do websites see my fingerprint?
No. Biometrics stay on your device.
What if a site does not support passkeys?
Use a strong unique password and two-factor authentication.
The Bottom Line
Passkeys offer phishing-resistant, convenient sign-ins. Use them where supported, store them in a place you trust, protect your sync account and keep recovery options.
Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.