Chykalophia Docs

Passkeys are a new, password-free way to log in that is more secure and easier than passwords. Here is what they are and how they work.

Passkeys are a newer way to log into websites and apps — without typing a password at all. Instead, you use your phone's Face ID, fingerprint, or PIN to prove it's you. They are more secure than passwords and significantly harder to steal or phish.

You may have already seen passkeys offered by Google, Apple, Microsoft, GitHub, Shopify, and many other services.

Quick summary

A passkey replaces your password with your device's biometrics (Face ID, fingerprint) or PIN. Each passkey is tied to the web address it was created for, so a look-alike phishing site cannot use it, and there is no password or code for you to hand over by mistake. When a service offers a passkey, it is worth using: GitHub's own documentation says passkeys are "much harder to attack than SMS or TOTP 2FA, which can be phished." The UK's National Cyber Security Centre recommends making passkeys your first choice of login wherever they are offered.

Why passkeys are more secure than passwords

Passwords have two fundamental weaknesses:

They can be stolen — through phishing, data breaches, or malware
People reuse them — so one breach affects many accounts

Passkeys solve both problems. Here is how:

A passkey is a pair of keys. The private key stays on your device and is the one that actually signs you in. The matching public key is stored by the website, and Apple's own security documentation is blunt about it: "This public key is not a secret." On its own it cannot log anyone in.
Nothing is transmitted that can be stolen. When you log in, your device proves it has the private key using cryptography — without sending the key itself. The server never learns what your private key is.
Phishing is far harder. A passkey is tied to the exact domain it was created for. Microsoft's example: a passkey created for netflix.com can only be used with netflix.com, so if you are tricked onto a similar-looking site, your device will not offer the passkey at all.
Your biometrics stay on your device. The website never receives your fingerprint or face data — only the cryptographic proof that your device approved the login.

What logging in with a passkey looks like

In practice, using a passkey is very simple:

Go to the website's login page.

Choose the passkey option. Click "Sign in with passkey" or enter your username and select the passkey option.

Confirm it is you. Your device prompts you for Face ID, Touch ID, fingerprint, or your device PIN.

You're in. That's it.

No password to type. No 2FA code to look up. Fast and secure.

Where passkeys are stored

Passkeys sync through your device's ecosystem:

Passkeys on iPhone, iPad, and Mac are stored in iCloud Keychain, which syncs them across your Apple devices. To use passkeys at all, iCloud Keychain and two-factor authentication must be turned on for your Apple Account.

If you get a new iPhone, your passkeys come with it. You view and manage them in the Passwords app (iOS 18 and macOS Sequoia or later). On macOS Sonoma or earlier, they are in System Settings → Passwords and in Safari's settings instead.

Creating a passkey

When a site offers a passkey, you'll usually see the option during sign-up or in your account's security settings:

Log into your account using your existing password.

Open your security settings. Look for "Passkeys" or "Add a passkey."

Click to create a passkey. Your device will prompt you to verify with Face ID, fingerprint, or PIN.

The passkey is created and saved to your device automatically.

Do I still need a password after setting up a passkey?

It depends on the service. On GitHub, for example, a passkey replaces both the password and the second-factor step at sign-in — GitHub's docs say passkeys "satisfy both password and 2FA requirements, so you can complete your sign in with a single step" — but the account still has a password behind it. Most services keep your password as a fallback in the same way.

Because that password is still there, you should still make it strong and unique. See How to create strong passwords.

Do passkeys replace 2FA?

Often, yes. The FIDO Alliance, which sets the passkey standards, says passkeys "leverage multiple factors for authentication": the passkey is on a device you have, and using it needs your fingerprint, face, or PIN. FIDO also says passkeys can replace older multi-factor setups such as a password plus an SMS code.

Two caveats. FIDO notes that "some regulatory regimes still have to evolve to recognize passkeys as one of the officially listed forms of multi-factor authentication" — so if a rule you have to meet lists the methods it accepts, check it. And some high-security accounts still layer extra verification on top. Follow the recommendations of each service.

Common questions

What if I lose my phone — do I lose my passkeys?

If you use iCloud Keychain or Google Password Manager, passkeys are backed up to the cloud and restore when you sign into a new device. A third-party manager like 1Password also backs up passkeys. You should keep a backup method on each account — usually your existing password or a backup code — so you can still get in.

Can I use a passkey across different types of devices?

Yes, in a few ways. If you store passkeys in a cross-platform manager like 1Password or Bitwarden, they work on any device where that manager is installed. If you're on a device that doesn't have your passkey, the site can show a QR code that you scan with your phone to approve the login; a proximity check happens during that flow, so the phone has to be near the computer and a remote attacker cannot use it.

Are passkeys supported everywhere?

Not yet, but support keeps growing. Google, Apple, Microsoft, GitHub, and Shopify all support passkeys, and more services add them regularly. Plenty of smaller sites still offer only passwords, so you will be using both for a while.

Is this different from Face ID to unlock my phone?

Yes, but related. Face ID unlocking your phone is local — it just unlocks the device. A passkey uses Face ID (or another method) to prove your identity to an external website, using cryptography. Face ID is the gesture that triggers the passkey; the passkey is the actual login credential.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.

Passkeys, explained