What Are Passkeys? A Practical Guide to Going Passwordless

What are passkeys, and why does every app suddenly want you to create one? The short answer: passkeys are a password replacement that you unlock with your face, fingerprint or device PIN, and they are built so that a fake login page simply cannot steal them. If you have been putting off the switch because it sounds complicated, this guide walks through how passkeys work, what you need, where they are stored and how to move your most important accounts over safely.

• What they are: passkeys are FIDO2-based sign-in credentials (WebAuthn plus CTAP) stored on your phone, computer or a hardware security key, according to the FIDO Alliance.
• Why they are safer: they use public-key cryptography, so there is no shared secret on the website's server to leak and nothing a phishing page can reuse.
• What you need: for a Google Account, Google lists Windows 10+, macOS Ventura+, ChromeOS 109+, Android 9+ or iOS 16+, plus Chrome 109+, Safari 16+, Edge 109+ or Firefox 122+.
• Adoption: a 2024 survey cited by the FIDO Alliance found 53% of people had enabled a passkey on at least one account.

Quick Picks: The Fastest Way to Start

If you only have ten minutes, do these in order:

• Your email account first. Email is the master key for every password reset, so a passkey here protects everything downstream.
• Your phone's built-in passkey manager. On iPhone, iPad and Mac that is the Passwords app with iCloud Keychain; on Android it is Google Password Manager.
• A hardware security key for your most valuable account. Device-bound passkeys on a FIDO security key are the highest-assurance option, per the FIDO Alliance.
• Keep one recovery method current. A backup phone number, recovery email or second security key means a lost phone is an inconvenience, not a lockout.

What Are Passkeys, Exactly?

A passkey is a pair of cryptographic keys created specifically for one website or app. The site keeps the public key. Your device keeps the private key and never hands it over. When you sign in, the site sends a one-time challenge, your device signs it with the private key after you unlock it, and the site checks the signature with the public key it already holds.

That design has a lovely consequence for defenders: the website never stores anything that works as a password. If a service's database is ever exposed, the public keys inside it are useless for logging in. And because each passkey is bound to the exact website domain that created it, a lookalike phishing domain has no way to ask your device for a valid signature. Your phone will simply not offer the passkey there.

The FIDO Alliance, the industry group behind the standard, describes passkeys as "always strong and phishing-resistant", which is a fair summary. You cannot pick a weak passkey, you cannot reuse one across sites, and you cannot be tricked into typing one into the wrong box.

Is My Fingerprint Sent to the Website?

No. This is the single most common worry, and it is worth clearing up. Your face, fingerprint or PIN only unlocks the passkey on your own device. Google's support documentation is explicit that biometric data stays on your device. The website only ever sees the cryptographic signature, never your biometrics.

How Are Passkeys Different From Passwords and 2FA?

Think of it as three generations of sign-in:

• Passwords: a shared secret that both you and the website know. Anyone who learns it, through a breach, a reused password or a convincing fake page, can use it.
• Passwords plus one-time codes: much better, but a real-time phishing page can still relay both your password and your six-digit code to the attacker.
• Passkeys: nothing is shared and nothing is typed. The signature only works for the real domain, which closes the relay trick that defeats one-time codes.

Passkeys also tend to replace two steps with one. Google notes that when you sign in with a passkey, it skips the separate 2-Step Verification prompt, because possession of your unlocked device already proves two factors at once: something you have (the device) and something you are or know (your biometric or PIN).

Synced Passkeys vs Device-Bound Passkeys

There are two flavors, and choosing between them is the main decision you will make.

• Synced passkeys are copied securely across your devices by a passkey provider. Apple stores them in iCloud Keychain, so a passkey made on your iPhone is available on your Mac signed in to the same Apple Account. Google Password Manager and third-party password managers do the same across their ecosystems. This is the convenient default for most people.
• Device-bound passkeys never leave a single device. The classic example is a passkey stored on a FIDO hardware security key that plugs into USB or taps over NFC. The FIDO Alliance says these offer the highest security assurance, which makes them a great fit for admin accounts, work accounts and anything financial.

A sensible setup for most households is synced passkeys for everyday accounts and a pair of hardware keys (one daily, one in a drawer) for the accounts that would hurt the most to lose.

What Do You Need to Use Passkeys?

Most devices sold in the last few years already support them. Google's published requirements for a Google Account passkey are a good baseline for the wider web:

• Computers: Windows 10 or later, macOS Ventura or later, or ChromeOS 109 or later.
• Phones: Android 9 or later, or iOS 16 or later.
• Browsers: Chrome 109+, Safari 16+, Edge 109+ or Firefox 122+.
• Hardware keys: any security key that supports FIDO2.

Before you start, Google recommends turning on your phone's screen lock, enabling Bluetooth if you plan to use your phone to sign in on a nearby computer, and switching on iCloud Keychain on Apple devices. Apple's own guide adds that you can verify with Touch ID, an iPhone or iPad, or an external security key when saving a new passkey on a Mac.

How to Switch Your Accounts to Passkeys, Step by Step

Here is the routine I recommend, account by account:

1. Start with email. Open your account's security settings and look for a "Passkeys" or "Passkeys and security keys" section. Create one on the phone you carry every day.
2. Confirm your recovery options. Before going further, check that your recovery email and phone number are current. Adding a passkey does not remove your existing recovery or sign-in methods, according to Google.
3. Add a second device. If your provider syncs, this may happen automatically. If you use hardware keys, register both of them now.
4. Accept the prompts as they appear. Many banks, shopping sites and developer platforms now offer "Create a passkey?" right after you sign in. Say yes on your own devices.
5. Move up to your money and work accounts. Banking, brokerage and your employer's single sign-on are worth doing next. Some workplace accounts may only accept a passkey as a second factor, which is still a big upgrade.
6. Use your phone for computers you do not own. On a borrowed laptop, choose "use a phone or tablet," scan the QR code and approve on your phone over Bluetooth. Nothing is saved on the borrowed machine.
7. Retire old passwords gradually. Once a passkey is working everywhere you sign in, consider changing the old password to a long random one stored in your password manager, so it is no longer a weak spot.

Where Are Passkeys Stored, and Can I Move Them?

Your passkeys live in whichever credential manager created them: Apple Passwords and iCloud Keychain, Google Password Manager, Windows Hello, a third-party password manager or a hardware key. Historically that meant some lock-in, but the industry is steadily fixing it. As we covered when Android added secure passkey transfer between password managers, moving credentials no longer has to mean exporting an unencrypted file.

If you want everything in one place across Apple, Android and Windows, a cross-platform password manager that supports passkeys is the simplest route. If you live mostly inside one ecosystem, its built-in manager works well and costs nothing extra.

What Happens If I Lose My Phone?

This is the second most common question, and the answer is reassuring if you planned ahead.

• Synced passkeys survive. Sign in to your Apple, Google or password-manager account on a new device and your passkeys come back with it.
• Remove the lost device's access. Google's guide recommends signing in on another device and removing the passkey or signing out of the lost phone from your account's device list.
• Device-bound keys need a spare. If a hardware key is your only passkey for an account and it goes missing, you will fall back on that account's recovery process. That is exactly why a second registered key is worth the small cost.

One practical caution from Google: only create passkeys on devices you personally own and control. Anyone who can unlock that device can use its passkeys, so a shared family tablet is not the right home for them.

Are Passkeys Safe for Families and Older Relatives?

Very often they are easier than passwords, which is the best security news of all. There is nothing to remember, nothing to type and nothing a scam caller can talk someone into reading out. For a parent or grandparent who already unlocks a phone with their face, signing in to their email with the same gesture is a natural fit. Just make sure their recovery phone number and email are up to date, and sit with them for the first couple of sign-ins.

Passkeys also pair nicely with the other everyday habits we recommend in our AI security coverage, such as keeping devices updated and turning on built-in protections. Messaging apps are on board too: WhatsApp now supports passkeys across multiple devices for its two-step verification.

Do Passkeys Work Everywhere Yet?

Not everywhere, but support grows every month. Major platforms from Apple, Google and Microsoft support them, along with a large and growing list of banks, retailers, social networks and developer tools. Where a site does not offer passkeys yet, a strong unique password from a password manager plus an authenticator app remains a solid fallback. The goal is not perfection on day one; it is moving your most important accounts first and letting the rest follow as sites add support.

The Bottom Line

Passkeys are one of the rare security upgrades that are also more convenient. They remove the shared secret that phishing and data breaches depend on, they work with the face or fingerprint unlock you already use dozens of times a day, and the major platforms now sync them across your devices. Start with your email account this weekend, add a backup recovery method, and let the rest of your accounts follow one prompt at a time.

Sources: FIDO Alliance: Passkeys — accessed October 16, 2026; Google Account Help: Sign in with a passkey instead of a password — accessed October 16, 2026; Apple Support: Sign in to an account on your Mac with a passkey — accessed October 16, 2026.