A passkey is a way of signing in to a website or app without typing a password. Instead, you unlock your phone or computer the way you already do, with your fingerprint, your face or your screen-lock PIN, and the device proves to the website that it is really you. Google sums up the main benefit neatly: a passkey “can’t be shared, copied, written down, or accidentally given to someone else”.
That last part is the point. Most account break-ins start with a password that was guessed, reused or typed into a fake website. A passkey removes all three. Below you will find how it works in plain terms, where it lives, what happens if you lose your phone, and how to make your first one in about two minutes.
How a passkey works, without the maths
Think of an old-fashioned padlock and key. When you create a passkey for, say, your Google Account, your phone makes a matching pair:
- The padlock (what Apple’s security guide calls the public key) goes to the website and is stored there.
- The key (the private key) stays on your device and never leaves it.
When you sign in, the website sends a little challenge. Your device uses the key to answer it, but only after you unlock it with your face, finger or PIN. The website checks the answer against its padlock. If it fits, you are in.
According to Apple’s passkey security overview, the website never learns the private key, and nothing secret travels across the internet during sign-in. So even if the company holding the padlocks is hacked, there is nothing useful for the thieves to steal.
Passkey vs password: what actually changes for you
| Password | Passkey | |
|---|---|---|
| What you do | Type something you remember | Unlock your phone or computer |
| Can it be guessed? | Yes, if it is weak | No |
| Can a fake website steal it? | Yes, if you type it in | No, it only works on the real site |
| Leaked in a data breach? | Often | The site holds nothing secret |
| Can you tell it to someone? | Yes, including scammers | No |
That third row matters most for everyday people. Phishing works by sending you to a convincing copy of a real site. Apple describes passkeys as resistant to phishing because each one is tied to the genuine website it was made for. If you have ever worried about spotting a phishing email, a passkey takes some of that weight off your shoulders: a fake page simply cannot use it.
Where your passkeys are kept
This depends on which devices you use.
- iPhone, iPad and Mac: passkeys are saved in iCloud Keychain and sync between your Apple devices. Apple says this sync is end-to-end encrypted, and your Apple Account must have two-factor authentication switched on before you can use it.
- Android phones and Chrome: passkeys are usually saved in Google Password Manager.
- A password manager app such as the one in our password manager setup guide: many now store passkeys too. Google’s help page confirms that a passkey can live in a third-party credential manager.
- A hardware security key: a small USB or NFC key you plug in or tap. Mostly used by people who want the strictest protection.
Your fingerprint or face scan is not stored in the passkey and is not sent to the website. Google’s page states that biometric data stays on your device.
What happens if you lose your phone?
This is the question everyone asks, and the honest answer is: less than you might fear, provided you prepare.
If your passkeys sync
Passkeys saved in iCloud Keychain or Google Password Manager are backed up to your account. Sign in on your new phone and they come back. Apple describes a recovery process that works even if you lose every Apple device, using your Apple Account details, a text message code and your old device passcode.
If someone else has the phone
Google’s help page gives a clear warning: once a passkey exists on a device, “anyone who can unlock your device can access your Google Account”. So a strong screen-lock PIN matters more than ever. If a phone is lost or stolen, sign in to your Google Account from another device, go to Security & sign-in > Passkeys and security keys, choose the passkey and tap Remove.
Your password does not disappear
Creating a passkey does not delete your password or your recovery options. Google says your existing sign-in and recovery methods stay as they are. You can still get in the old way if you need to.
Make your first passkey: Google Account in two minutes
Google is a good place to start because almost everyone has an account. These steps follow Google’s passkey help page:
- On your own phone or computer, go to myaccount.google.com/signinoptions/passkeys.
- Tap Create a passkey, then tap Create a passkey again.
- Unlock your device when asked, with your fingerprint, face or PIN.
Next time you sign in to Google on that device, you will be asked to unlock it instead of typing your password. By default Google tries the passkey first. If you prefer the password, there is a setting called Skip password when possible under Security & sign-in that you can turn off.
One rule from Google worth repeating: only create passkeys on devices you personally own. Not the library computer, not a friend’s tablet, not a shared family laptop that others can unlock.
Signing in on a computer that is not yours
You can still use a passkey that lives on your phone. On many sign-in pages there is an option such as Use another device. The computer shows a QR code; you scan it with your phone, unlock the phone, and you are signed in. The passkey itself stays on your phone; nothing is saved on the borrowed computer.
Common worries, answered plainly
- “Is this just two-factor authentication?” Not quite. Two-factor adds a second step after your password. A passkey replaces the password, and the unlocking step is built in. If you already use two-factor authentication, keep it switched on; it still protects your recovery route.
- “Can the website see my fingerprint?” No. The fingerprint only unlocks your own device.
- “What if a site does not offer passkeys?” Keep using a strong, unique password stored in a password manager. Plenty of sites do not support passkeys yet.
If you have ever had an email from a site saying your details appeared in a breach, it helps to understand what being “pwned” means. Passkeys are the answer to that problem: a breached site holding only padlocks gives attackers nothing to log in with.
Where to switch passkeys on first
Start with the accounts that unlock everything else:
- Your main email account (Google, Microsoft or Apple).
- Your phone’s own account, because it controls your backups.
- Shopping sites that store your card, such as Amazon.
- Your bank, if it offers passkeys. Many banks use their own app instead.
Do one today. Once you have unlocked your phone instead of typing a password a few times, the old way starts to feel slow.
Frequently Asked Questions
Are passkeys safer than passwords?
For most people, yes. A passkey cannot be guessed, reused on another site, or typed into a fake page, which are the three most common ways accounts get broken into. It still depends on your phone or computer having a decent screen lock, because anyone who can unlock the device can use the passkeys on it.
Can I use the same passkey on my iPhone and my Windows laptop?
Not by copying it across directly, but you can use your phone to sign in on the laptop by scanning a QR code, or create a second passkey on the laptop. Each site lets you hold several passkeys, one for each device or password manager.
Do I need to delete my password after making a passkey?
No. Your password stays in place as a fallback. Keep it strong and unique, and keep your recovery phone number and email up to date. Some people later turn off password sign-in where a site allows it, but that is optional.
Why does a site keep asking me to create a passkey?
Many companies are encouraging passkeys because they cut down on hacked accounts and password-reset requests. You can usually tap “Not now”. There is no penalty for waiting, but there is a real security gain if you accept on a device you own.
Last updated: November 15, 2026