Passkeys Explained: What They Are and How to Set Them Up

Passwords get stolen, reused, phished and forgotten. Passkeys are the replacement that Google, Microsoft, Apple and most major apps are now pushing everyone toward. Instead of typing a password, you unlock your account with your fingerprint, face or phone screen lock.

This guide explains what passkeys are, why they're safer than passwords plus OTPs, and how to set them up on your most important accounts.

What is a passkey?

A passkey is a digital key stored on your phone, computer or password manager. When you create one, your device generates a pair of keys:

• a private key that never leaves your device, and
• a public key that the website stores.

To sign in, the website sends a challenge, your device signs it with the private key after you unlock it with your fingerprint, face or PIN, and the website checks the signature. There's no password to type, remember or leak.

Why passkeys are safer than passwords

• Phishing-resistant: a passkey only works on the real website it was created for. A fake login page can't trick it.
• Nothing to steal from servers: websites only store your public key, which is useless to hackers.
• No reuse: every passkey is unique to one website.
• No OTP interception: SMS codes can be stolen through SIM-swap fraud or tricked out of you over the phone. Passkeys need your physical device and your biometric or screen lock.

Your fingerprint or face data is not sent to the website. It only unlocks the passkey on your own device.

Where are passkeys stored?

• Android and Chrome: in Google Password Manager, synced across your signed-in devices.
• iPhone, iPad and Mac: in iCloud Keychain (the Passwords app), synced across your Apple devices.
• Windows: on the PC through Windows Hello, or in your browser's password manager.
• Password managers: 1Password, Bitwarden, Dashlane and others can store and sync passkeys across platforms.
• Hardware security keys: a physical USB/NFC key such as a YubiKey.

How to set up a passkey on your Google account

1. Go to myaccount.google.com and open Security (or Security & sign-in).
2. Under "How you sign in to Google," select Passkeys and security keys.
3. Choose Create a passkey and confirm with your fingerprint, face or screen lock.

Google has offered passkeys as the default sign-in for personal accounts since 2023, so you may already see a prompt to create one.

How to set up a passkey on your Microsoft account

1. Sign in at account.microsoft.com and open Security.
2. Go to Manage how I sign in (sign-in options).
3. Choose to add a passkey (shown as face, fingerprint, PIN or security key) and follow the prompts on your PC or phone.

Microsoft made passkeys the default for new accounts in 2025 and lets existing users go fully passwordless. Before removing your password, make sure you have a second sign-in method, such as the Microsoft Authenticator app.

Other apps worth securing with passkeys

• WhatsApp: Settings > Account > Passkeys, so you can verify a new login without waiting for an SMS code.
• Amazon: Your Account > Login & security > Passkey.
• Apple, PayPal, GitHub, LinkedIn and many others also support passkeys. Look for "Passkeys" or "Sign-in options" in the security settings.

Menu names change over time, so if you can't find the option, search the app's settings for "passkey."

What if I lose my phone?

If your passkeys are synced (Google Password Manager, iCloud Keychain or a password manager), they come back when you sign in on a new device. Passkeys stored only on one device or security key don't sync, which is why you should always keep a backup:

• keep at least two sign-in methods on important accounts,
• save your account recovery codes somewhere safe offline,
• keep your recovery email and phone number up to date.

Passkey limitations to know

• Not every website supports passkeys yet, so you'll still need some passwords. Use a strong, memorable passphrase and a password manager for those.
• Signing in on a friend's computer usually works by scanning a QR code with your phone, which needs Bluetooth on both devices.
• Moving passkeys between ecosystems (for example from Apple to Google) is still improving, so a cross-platform password manager is easiest if you use mixed devices.

FAQ

Can someone use my passkey if they steal my phone?

Not without unlocking it. A passkey requires your fingerprint, face or device PIN, so set a strong screen lock and don't share it.

Do passkeys replace two-factor authentication?

Passkeys combine "something you have" (your device) with "something you are or know" (biometric or PIN), so they already provide strong two-factor protection in one step.

Should I delete my passwords after creating passkeys?

Only when the service allows it and you have backup sign-in methods ready. Otherwise, keep a strong unique password as a fallback.

Protect your Windows PC too: here's how to find your BitLocker recovery key before you need it.