What are passkeys? A simple guide to logging in without passwords

Quick answer: A passkey is a login that replaces your password. Instead of typing something, you unlock with your fingerprint, face or device PIN. Behind the scenes, your device holds a private key that never leaves it and the website keeps only a public key — so there's nothing to phish, guess or leak. Passkeys sync across your devices through Google Password Manager, iCloud Keychain, Microsoft or a password manager, and they now handle about 36% of sign-ins on major services.

Key takeaways

• Passkeys are phishing-resistant: they only work on the real website they were made for.
• Your fingerprint or face never leaves your phone — it just unlocks the passkey locally.
• FIDO estimates about 7 billion passkeys are in use, and passkey sign-ins succeed 93% of the time vs 78% for passwords.
• If you lose your phone, synced passkeys are restored when you sign in to your Google, Apple or password-manager account on a new device.
• Start with your email account — it's the key to resetting everything else.

Passwords get stolen in data breaches, reused across sites and typed into fake login pages. Passkeys fix all three problems. This guide explains how they work in plain language, how to set them up on the services you already use, and what to do if you lose your phone.

#How a passkey works (in plain words)

When you create a passkey for a website:

1. Your device creates a pair of keys: a private key (kept secret on your device, protected by your screen lock) and a public key (sent to the website).
2. When you log in, the website sends a challenge.
3. You unlock with your fingerprint, face or PIN, and your device signs the challenge with the private key.
4. The website checks the signature with your public key. If it matches, you're in.

The website never stores a secret that could be stolen in a breach. And because the passkey is tied to the real website address, a fake site can't use it.

#Passkeys vs passwords vs OTPs

#How to set up passkeys on popular accounts

Google account

1. Go to myaccount.google.com → Security → Passkeys and security keys (or g.co/passkeys).
2. Click Create a passkey and follow the prompt to use your fingerprint, face or screen lock.
3. On Android, passkeys sync through Google Password Manager.

Apple (iPhone, iPad, Mac)

• Passkeys are stored in iCloud Keychain (in the Passwords app).
• When a site or app offers a passkey, tap Continue and confirm with Face ID or Touch ID.
• Turn on iCloud Keychain in Settings → your name → iCloud → Passwords and Keychain, so passkeys sync to all your Apple devices.

Microsoft account

1. Go to account.microsoft.com → Security → Manage how I sign in.
2. Choose Add a new way to sign in → Face, fingerprint, PIN or security key.
3. Windows uses Windows Hello to protect the passkey.

Other services that support passkeys

Many big services now offer passkeys, including Amazon, PayPal, WhatsApp, GitHub, LinkedIn, X, eBay, Uber, Best Buy, Kayak and a growing list of banks. Look in Settings → Security or Login options for "Passkey".

Tip: Set up a passkey for your email first. Whoever controls your email can reset almost every other account.

#Where your passkeys are stored

If you use both an iPhone and a Windows PC, a password manager that supports passkeys is often the easiest way to have them everywhere. See our password manager guide.

#Logging in on someone else's computer

You can use the passkey on your phone to log in on a computer that isn't yours:

1. Choose "Use a phone or tablet" (or a similar option) on the login screen.
2. A QR code appears. Scan it with your phone's camera.
3. Confirm with your fingerprint or face. Bluetooth checks that your phone is physically nearby, so this can't be done remotely by an attacker.

#What if I lose my phone?

• Synced passkeys (Google, Apple, password managers) come back when you sign in to that account on a new device.
• That's why the account that stores your passkeys needs strong protection — set up recovery options (a recovery email, a recovery contact or recovery key) for your Google, Apple or password-manager account.
• Keep at least two ways to sign in to important accounts — for example a passkey on your phone and one on your laptop, or a hardware key in a drawer.

Warning: Don't delete your password the moment you add a passkey unless the site lets you go fully passwordless and you have backup sign-in methods set up.

#Common worries, answered

• "Does the website get my fingerprint?" No. Your biometric data stays on your device and only unlocks the passkey locally.
• "Can someone with my phone log in?" They'd also need your fingerprint, face or PIN.
• "Can I share a passkey?" Some password managers and Apple's shared password groups let you share passkeys with family.
• "What if a site doesn't support passkeys?" Use a password manager with long random passwords and two-step verification.

#Frequently asked questions

Are passkeys safer than passwords?

Yes. They can't be phished, guessed or leaked in a data breach, because the website never stores a secret.

Do passkeys use my fingerprint?

They use your fingerprint, face or PIN only to unlock the passkey on your device. The fingerprint itself never leaves the device.

Can I use a passkey on multiple devices?

Yes, if it's synced through Google, Apple, Microsoft or a password manager. You can also scan a QR code to use your phone's passkey on another computer.

What happens to my passkeys if I lose my phone?

Synced passkeys are restored when you sign in to your Google, Apple or password-manager account on a new device.

Do I still need a password?

For now, most sites keep a password as a backup. Some let you remove it once you have passkeys and recovery set up.

Which apps support passkeys?

Google, Apple, Microsoft, Amazon, PayPal, WhatsApp, GitHub and many others — and the list grows every month.

Are passkeys the same as two-factor authentication?

A passkey is already strong because it combines something you have (your device) with something you are or know (biometric or PIN). Many sites treat it as both factors in one.

#Sources

• FIDO Alliance — Passkeys
• Start with Identity — FIDO Passkey Index 2026: 36% of sign-ins, 7 billion passkeys
• Google — Sign in with a passkey
• Apple Support — About passkeys
• PayPal — How do passkeys work?