# What are passkeys? A simple guide to logging in without passwords

> Passkeys replace passwords with your fingerprint, face or PIN. They can't be phished or leaked. How they work, how to set them up on Google, Apple, Microsoft, and common worries.

- URL: https://2search.in/knowledge/articles/oct-26/passkeys-explained
- Genre: Technology
- Country: Everywhere
- Published: 2026-10-27
- Updated: 2026-10-27
- Publisher: 2search (https://2search.in)

> **Quick answer:** A **passkey** is a login that replaces your password. Instead of typing something, you unlock with your **fingerprint, face or device PIN**. Behind the scenes, your device holds a **private key** that never leaves it and the website keeps only a **public key** — so there's **nothing to phish, guess or leak**. Passkeys sync across your devices through **Google Password Manager, iCloud Keychain, Microsoft or a password manager**, and they now handle about **36% of sign-ins** on major services.

> **Key takeaways**
> - Passkeys are **phishing-resistant**: they only work on the real website they were made for.
> - Your **fingerprint or face never leaves your phone** — it just unlocks the passkey locally.
> - FIDO estimates about **7 billion passkeys** are in use, and passkey sign-ins succeed **93%** of the time vs **78%** for passwords.
> - If you lose your phone, **synced passkeys** are restored when you sign in to your Google, Apple or password-manager account on a new device.
> - Start with your **email account** — it's the key to resetting everything else.

Passwords get stolen in data breaches, reused across sites and typed into fake login pages. Passkeys fix all three problems. This guide explains how they work in plain language, how to set them up on the services you already use, and what to do if you lose your phone.



![What are passkeys? A simple guide to logging in without passwords Breakdown & Visual Guide](/images/articles/passkeys-explained/diagram.svg)

## How a passkey works (in plain words)

When you create a passkey for a website:

1. Your device creates a **pair of keys**: a **private key** (kept secret on your device, protected by your screen lock) and a **public key** (sent to the website).
2. When you log in, the website sends a **challenge**.
3. You unlock with your **fingerprint, face or PIN**, and your device **signs** the challenge with the private key.
4. The website checks the signature with your public key. If it matches, you're in.

The website **never stores a secret** that could be stolen in a breach. And because the passkey is tied to the real website address, a fake site can't use it.

## Passkeys vs passwords vs OTPs

| | Password | Password + SMS OTP | **Passkey** |
| --- | --- | --- | --- |
| Can be phished | Yes | Yes (OTPs can be stolen) | **No** |
| Leaked in data breaches | Yes | Password yes | **No** |
| Can be reused across sites | Often | Often | **No — unique per site** |
| You have to remember it | Yes | Yes | **No** |
| Speed | Slow | Slower | **Fast — one touch** |
| Works if SIM is swapped | — | Attackers can intercept | **Yes, safe** |

## How to set up passkeys on popular accounts

### Google account

1. Go to **myaccount.google.com → Security → Passkeys and security keys** (or g.co/passkeys).
2. Click **Create a passkey** and follow the prompt to use your fingerprint, face or screen lock.
3. On Android, passkeys sync through **Google Password Manager**.

### Apple (iPhone, iPad, Mac)

- Passkeys are stored in **iCloud Keychain** (in the **Passwords** app).
- When a site or app offers a passkey, tap **Continue** and confirm with **Face ID or Touch ID**.
- Turn on **iCloud Keychain** in Settings → your name → iCloud → Passwords and Keychain, so passkeys sync to all your Apple devices.

### Microsoft account

1. Go to **account.microsoft.com → Security → Manage how I sign in**.
2. Choose **Add a new way to sign in → Face, fingerprint, PIN or security key**.
3. Windows uses **Windows Hello** to protect the passkey.

### Other services that support passkeys

Many big services now offer passkeys, including **Amazon, PayPal, WhatsApp, GitHub, LinkedIn, X, eBay, Uber, Best Buy, Kayak** and a growing list of banks. Look in **Settings → Security** or **Login options** for "Passkey".

> **Tip:** Set up a passkey for your **email first**. Whoever controls your email can reset almost every other account.

## Where your passkeys are stored

| Where | Syncs to | Good for |
| --- | --- | --- |
| **Google Password Manager** | Android, Chrome on any device | Android users |
| **iCloud Keychain** | iPhone, iPad, Mac | Apple users |
| **Windows Hello / Microsoft** | Windows PCs (with growing sync support) | Windows users |
| **Password managers** (1Password, Bitwarden, Dashlane, Proton Pass and others) | All platforms | Mixed Apple / Android / Windows households |
| **Hardware security keys** (YubiKey, Titan) | Not synced — the key itself | Highest security, journalists, admins |

If you use both an iPhone and a Windows PC, a **password manager** that supports passkeys is often the easiest way to have them everywhere. See our [password manager guide](/password-manager-guide).

## Logging in on someone else's computer

You can use the passkey on your phone to log in on a computer that isn't yours:

1. Choose **"Use a phone or tablet"** (or a similar option) on the login screen.
2. A **QR code** appears. Scan it with your phone's camera.
3. Confirm with your fingerprint or face. Bluetooth checks that your phone is physically nearby, so this can't be done remotely by an attacker.

## What if I lose my phone?

- **Synced passkeys** (Google, Apple, password managers) come back when you sign in to that account on a new device.
- That's why the account that **stores** your passkeys needs strong protection — set up **recovery options** (a recovery email, a recovery contact or recovery key) for your Google, Apple or password-manager account.
- Keep **at least two ways** to sign in to important accounts — for example a passkey on your phone and one on your laptop, or a hardware key in a drawer.

> **Warning:** Don't delete your password the moment you add a passkey unless the site lets you go fully passwordless and you have **backup sign-in methods** set up.

## Common worries, answered

- **"Does the website get my fingerprint?"** No. Your biometric data stays on your device and only unlocks the passkey locally.
- **"Can someone with my phone log in?"** They'd also need your **fingerprint, face or PIN**.
- **"Can I share a passkey?"** Some password managers and Apple's shared password groups let you share passkeys with family.
- **"What if a site doesn't support passkeys?"** Use a [password manager](/password-manager-guide) with long random passwords and two-step verification.

## Frequently asked questions

### Are passkeys safer than passwords?

Yes. They can't be phished, guessed or leaked in a data breach, because the website never stores a secret.

### Do passkeys use my fingerprint?

They use your fingerprint, face or PIN only to unlock the passkey on your device. The fingerprint itself never leaves the device.

### Can I use a passkey on multiple devices?

Yes, if it's synced through Google, Apple, Microsoft or a password manager. You can also scan a QR code to use your phone's passkey on another computer.

### What happens to my passkeys if I lose my phone?

Synced passkeys are restored when you sign in to your Google, Apple or password-manager account on a new device.

### Do I still need a password?

For now, most sites keep a password as a backup. Some let you remove it once you have passkeys and recovery set up.

### Which apps support passkeys?

Google, Apple, Microsoft, Amazon, PayPal, WhatsApp, GitHub and many others — and the list grows every month.

### Are passkeys the same as two-factor authentication?

A passkey is already strong because it combines something you have (your device) with something you are or know (biometric or PIN). Many sites treat it as both factors in one.

## Sources

- [FIDO Alliance — Passkeys](https://fidoalliance.org/passkeys/)
- [Start with Identity — FIDO Passkey Index 2026: 36% of sign-ins, 7 billion passkeys](https://startwithidentity.com/blog/2026-10-15-fido-passkey-index-2026-passkeys-reach-36-percent-of-sign-ins/)
- [Google — Sign in with a passkey](https://support.google.com/accounts/answer/13548313)
- [Apple Support — About passkeys](https://support.apple.com/en-us/102195)
- [PayPal — How do passkeys work?](https://paypal.com/us/money-hub/article/how-do-passkeys-work)