The short version
A passkey is a way to sign in to an account without typing a password. Instead, you unlock your phone or computer the way you normally do, with a fingerprint, face scan or device PIN, and the device proves to the website that it holds the right secret. You never create, remember or type the secret itself.
Passkeys are designed to address the weakest parts of passwords: people reuse them, choose guessable ones and give them away to fake sites.
How they work, without the math
When you create a passkey for an account, your device generates a pair of linked digital keys:
- A public key, which is sent to the website and stored there.
- A private key, which stays on your device and is never shared.
When you sign in, the website sends a challenge. Your device signs it using the private key, after you approve with your fingerprint, face or PIN. The website checks the signature with the public key. If it matches, you are in.
Two consequences follow. First, a website that is breached only holds public keys, which are of little use to a thief, unlike a leaked password. Second, there is nothing for you to type, so there is nothing to reveal on a convincing fake login page.
Why they resist phishing
A passkey is tied to the real website address it was created for. If you land on a lookalike page, your device will not offer the passkey, because the address does not match. With passwords, the decision about whether a page is genuine is left to you, which is how many phishing emails succeed. Passkeys remove that guess from the process.
Your fingerprint or face data generally stays on your device and is used only to unlock the private key, though the details depend on the device and the software.
Where passkeys are stored
Passkeys can live in different places:
- On a single device, such as a phone or laptop.
- Synced across your devices through the account that belongs to your phone or computer maker, or through a password manager that supports them.
- On a physical security key, a small hardware device you plug in or tap.
Synced passkeys are convenient because losing one phone does not lock you out. The cost is that the security of your passkeys now depends on the security of the account that syncs them. Protect that account with a strong passphrase and two-factor authentication.
Limits and trade-offs
Passkeys are promising, but they are not a cure-all.
- Uneven support. Not every site or app offers them yet, and some offer them only as an add-on to a password, so you will use both for a while.
- Device loss. If your only passkey is on a lost phone and nothing is synced, you will need a recovery route. That makes account recovery options important to set up in advance.
- Shared and borrowed devices. Passkeys work best on devices you own. Signing in from a friend’s computer may require using your phone to approve the sign-in or falling back to another method.
- Switching ecosystems. Moving between device makers may be easier in some cases than others, and the experience varies.
- Weak fallback paths. If a site still lets someone reset the account using only an email link or text code, an attacker may use that route instead. A passkey is only as strong as the weakest remaining way in.
- Device security still matters. Anyone who can unlock your phone with its PIN can possibly use your passkeys. A short, guessable device PIN is a weak point, and malware on a device is still a concern.
How to start
- Look in the security settings of your most important accounts, such as email, for an option named “passkey” or “passwordless sign-in.”
- Create a passkey on a device you control, and confirm it works by signing out and back in.
- Keep your existing recovery methods up to date, including backup codes.
- Make sure the device lock is strong and the account that syncs your passkeys is well protected.
- Add a second passkey, perhaps on another device or a security key, so one lost device does not cause lockout.
You do not need to abandon passwords overnight. Many people will use passkeys where they are offered and keep strong, unique passwords stored in a password manager everywhere else. This blended approach is a sensible stage in a gradual shift, and it improves protection without requiring you to understand the cryptography underneath.