Passkeys are a passwordless login method that replaces your password with a cryptographic key pair unlocked by your fingerprint, face, or device PIN — so there is no secret to phish, reuse, or steal in a breach.
If you have logged into a major website recently, you may have seen a prompt asking whether you want to save a “passkey.” Most people dismiss it. That is understandable — a new login concept buried in a dialog box is easy to ignore — but passkeys are worth stopping for, because they represent the first serious, broadly deployed replacement for the password in the thirty-year history of the web.
The short version is this: a passkey lets you log in with your fingerprint, face, or device PIN, and it is engineered so that the secrets involved never leave your device and cannot be stolen in a database breach. If you have ever had an account compromised through a phishing email or a leaked password list, passkeys are designed specifically to prevent both of those scenarios.
What a Passkey Actually Is
A passkey is a cryptographic key pair — two mathematically linked keys, one stored on your device and one registered with the website. When you create a passkey for a service, your device generates both keys locally. The website receives and stores only the public key. The private key never leaves your device, full stop.
When you log in, the website sends a one-time challenge. Your device signs that challenge with the private key and returns the signature. The website verifies the signature against the public key it already has. If the signature is valid, you are in. At no point does your device transmit anything that could be replayed or stolen — there is no password, no code, no shared secret crossing the wire.
The standard underpinning all of this is FIDO2 (Fast Identity Online), developed by the FIDO Alliance, a consortium that includes Apple, Google, Microsoft, and hundreds of other technology companies. FIDO2 is also the foundation for hardware security keys like YubiKey, which have been used in corporate and government settings for years. Passkeys bring the same fundamental technology to consumer devices without requiring extra hardware.
How This Differs From Two-Factor Authentication
Two-factor authentication (2FA) adds a second check on top of your password. It makes accounts harder to compromise, but the password is still the first factor, which means it can still be phished or leaked. A passkey replaces the password entirely. The biometric or PIN you use to unlock the passkey is just a local check to confirm you are present at the device — it is never sent anywhere, and the website never sees it.
How Do Passkeys Work Behind the Scenes?
Passkeys work through public-key cryptography: your device keeps a private key it never shares, the website keeps the matching public key, and every login is proven by signing a fresh one-time challenge rather than by sending a reusable secret. Understanding the mechanics makes the security benefits obvious rather than magical.
Think of the public key the website stores as a padlock and the private key on your device as the only key that fits it. The website can hand out as many copies of the open padlock as it likes — that is what sits in its database — but none of them help an attacker, because the padlock cannot be picked and the matching key never leaves your pocket. Each login, the site presents a brand-new lock to close; only your device can close it correctly, and the proof it sends back is useless the moment it is used. This is why there is nothing durable for a thief to capture. A stolen password works forever until you change it; a captured passkey signature is dead on arrival.
The other half of the design is that the passkey is tied to a specific website domain at the cryptographic level, not by the user remembering which site is real. Your device, not your attention, enforces that binding — which is what makes passwordless login resistant to human error in a way that no amount of “be careful what you click” advice ever achieved.
Why Passkeys Beat Passwords on Every Security Dimension That Matters
Passwords fail in three main ways: people reuse them across sites, they get leaked in breaches, and they get phished. Passkeys address all three.
Reuse is not possible. Each passkey is unique to a single website and generated fresh for that site. There is nothing to reuse elsewhere.
Passkeys lean on the same secure hardware that powers on-device AI — your phone is quietly becoming the vault for both.
Breaches cannot expose them. The website stores only your public key. If the site’s database is stolen, the attacker gets a public key — which is mathematically useless without the private key sitting on your device.
Phishing does not work. This is arguably the most important property. A passkey is cryptographically bound to the exact domain it was created for. If you are tricked into visiting goog1e.com instead of google.com, your device will refuse to sign the login challenge — there is no passkey registered for that domain. The authentication simply fails before you can be deceived. The FIDO Alliance has documented this phishing-resistance as a core design requirement, not an incidental benefit.
NIST’s Digital Identity Guidelines (SP 800-63B) have long identified phishing-resistant authentication as the gold standard for consumer accounts. Passkeys are the first widely available implementation of that standard for ordinary users.
Passkeys vs Passwords vs 2FA: What Actually Changes
A password is a shared secret you must remember and defend; two-factor authentication bolts a second shared secret onto the first; a passkey removes the shared secret entirely and replaces it with a proof only your device can produce. Laid side by side, the difference is not incremental.
With a password, the burden of security sits on you: pick something long, never reuse it, never type it into the wrong site, and hope the company storing it hashed it properly. With 2FA, you carry the same burden plus a second step — a texted code or an authenticator prompt — which helps but still leaves the password itself as a leakable, phishable first factor. Codes sent by SMS, in particular, can be intercepted or socially engineered, which is why security professionals treat SMS 2FA as the weakest of the common options.
A passkey collapses the whole arrangement. There is no secret for you to protect, nothing to type, and nothing for a fake site to capture. The trade is that your security now depends on controlling your device and your recovery options rather than on remembering and guarding a string of characters — a trade that favors almost everyone, because devices are easier to protect than memory is.
How to Start Using Passkeys Right Now
Setup takes roughly two minutes on any modern device. Here is the practical path for the three main platforms.
iPhone and iPad (iOS 16 or later)
Apple stores passkeys in iCloud Keychain, which syncs across all your Apple devices. When a supported site offers to save a passkey, accept the prompt and authenticate with Face ID or Touch ID. The passkey is saved and synced automatically. You can view all saved passkeys in Settings > Passwords. Apple’s Platform Security documentation explains the hardware-level protections (Secure Enclave) backing this storage.
Android (Android 9 or later)
Google Password Manager handles passkey storage and syncs through your Google account. The flow is identical: when a site offers a passkey, accept the prompt and use your fingerprint or screen lock. Google has also opened the Android Credential Manager API so third-party password managers like 1Password and Dashlane can store passkeys as well.
Windows 11 and macOS
Windows Hello supports passkeys natively on Windows 11 23H2 and later, storing them using the device’s TPM chip. On macOS Ventura and later, passkeys sync through iCloud Keychain the same as on iPhone. Chrome and Edge on both platforms also support device-bound passkeys that stay local to the machine and do not sync — useful if you prefer not to tie credentials to a cloud account.
Sites with strong passkey support as of mid-2026 include Google, Apple ID, Microsoft accounts, GitHub, PayPal, Shopify, and an increasing number of financial institutions. Check passkeys.directory (maintained by the FIDO Alliance community) for an up-to-date list.
What Are Synced vs Device-Bound Passkeys?
Synced passkeys copy across your devices through a cloud keychain so you can log in anywhere you are signed in; device-bound passkeys stay locked to a single piece of hardware and never leave it, trading convenience for a higher security ceiling. Both are real passkeys — the difference is where the private key is allowed to live.
Synced passkeys, the default on Apple and Google platforms, are the right choice for most people. If your phone falls in a lake, your passkeys are still in your account and land on your next device automatically. The trust boundary becomes your platform account, which is why securing that account matters so much. Device-bound passkeys — typical of hardware keys like a YubiKey, and available as an option in some browsers — never sync anywhere, so the only way to use one is to physically hold the device. That is stronger against remote compromise and is favored in high-security and enterprise settings, at the cost of needing a backup key in case you lose the first.
For a normal person securing personal accounts, synced passkeys plus a recovery method are the sensible default. For accounts where the stakes are unusually high, a pair of device-bound hardware keys — one in use, one in a drawer — is the more conservative setup.
The Honest Catches
Passkeys are better than passwords, but the ecosystem is still maturing. There are three friction points worth knowing before you go all-in.
Fewer passwords will not mean fewer logins, though — as we argue in our essay on the login-walled web, the prompts are multiplying for different reasons.
Account recovery is messier. If you lose all your devices and do not have backup access methods, recovering your accounts is harder than resetting a password via email. Most sites still let you fall back to a password or recovery code, but you need to set those backup methods up before you need them. Do this now, not when you are locked out.
Syncing has platform walls. Apple passkeys sync within Apple devices. Google passkeys sync within Android and Chrome. If you regularly switch between an iPhone and an Android phone, or between Safari and Firefox, you will hit friction. The FIDO Alliance and browser vendors are actively working on cross-platform passkey transfer standards, but the tooling is not seamless yet.
Not every site supports them. Adoption is growing fast, but plenty of smaller services and enterprise apps still rely entirely on passwords. Passkeys complement good password hygiene rather than replacing it overnight.
What to Do
The practical recommendation is straightforward. For your highest-value accounts — email, banking, Google, Apple ID, Microsoft — create a passkey the next time the site offers one, and do it now rather than dismissing the prompt again. These accounts are the primary targets of phishing and credential-stuffing attacks, and passkeys eliminate both vectors for them immediately.
For everything else, keep using a password manager with long, unique passwords and 2FA on any account that matters. Passkeys will gradually replace the password layer over the next few years as more services adopt them; the transition is not something you need to force all at once.
The broader shift is real and it is happening. The FIDO Alliance reported that over a dozen major platforms and hundreds of services had deployed passkey support by 2025, with billions of passkeys created across consumer devices. This is not vaporware or a niche security feature anymore — it is the new default authentication method on the most-used computing platforms in the world. The question is not whether to adopt it, but how quickly to do so for the accounts that matter most to you.
Frequently asked questions
What are passkeys and how do they work?
Passkeys are a passwordless login method built on public-key cryptography. Your device creates two linked keys: a private one that never leaves the device and a public one the website stores. To log in, your device signs a one-time challenge with the private key, and the site verifies it with the public key. No reusable secret is ever sent, so there is nothing to steal or reuse.
What is the difference between passkeys and passwords?
A password is a shared secret you type in, which can be reused, guessed, leaked in a breach, or phished. A passkey is a cryptographic key that stays on your device and is proven by a fresh signature each login. Because nothing reusable crosses the network and the key is bound to the real site’s domain, passkeys eliminate reuse, breach exposure, and phishing at once.
Are passkeys safer than two-factor authentication?
Yes, for most people. Two-factor authentication still relies on a password as its first factor, which can be phished or leaked, and SMS codes can be intercepted. A passkey removes the password entirely and is cryptographically bound to the correct website, so it resists phishing by design. It provides strong single-step protection rather than bolting a second check onto a weak foundation.
What happens to my passkeys if I lose my phone?
If you use synced passkeys on Apple or Google, they are stored in your platform account and reappear on your next device once you sign in, so a lost phone does not lock you out. The key is to set up recovery methods in advance. If you use device-bound passkeys, keep a backup hardware key, because those never leave the original device.
Can passkeys be phished or stolen in a data breach?
No. A passkey is bound to the exact website domain it was created for, so a fake lookalike site cannot trigger it — the login simply fails. And because websites store only your public key, a stolen database gives an attacker something mathematically useless without the private key on your device. The two most common ways accounts fall today are closed off.
Do I still need a password manager if I use passkeys?
For now, yes. Many sites and enterprise apps still require passwords, so a password manager remains useful for the accounts passkeys have not reached. Passkeys and password managers also increasingly work together, since managers like 1Password and Dashlane can store passkeys too. Treat passkeys as replacing the password layer gradually rather than all at once.
What are device-bound passkeys?
Device-bound passkeys are passkeys whose private key never leaves a single piece of hardware, such as a YubiKey or a specific computer. They do not sync to the cloud, so using one requires physically holding that device. This raises the security ceiling against remote attacks and is common in enterprise settings, at the cost of needing a backup key if the original is lost.
Which accounts should I set up passkeys for first?
Start with your highest-value accounts: primary email, banking, and your platform accounts like Google, Apple ID, and Microsoft. These are the main targets of phishing and credential-stuffing, and passkeys shut down both vectors immediately. Set up a passkey the next time each site offers one, and configure recovery options at the same time so you are never locked out.
