Passkeys, explained
Passkeys are a new, password-free way to log in that is more secure and easier than passwords. Here is what they are and how they work.
Passkeys are a newer way to log into websites and apps, without typing a password at all. Instead, you use your phone's Face ID, fingerprint, or PIN to prove it's you. They are more secure than passwords and significantly harder to steal or phish.
You may have already seen passkeys offered by Google, Apple, Microsoft, GitHub, Shopify, and many other services.
Why passkeys are more secure than passwords
Passwords have two fundamental weaknesses:
- They can be stolen: through phishing, data breaches, or malware
- People reuse them: so one breach affects many accounts
Passkeys solve both problems. Here is how:
- A passkey is a pair of keys. The private key stays on your device and is the one that actually signs you in. The matching public key is stored by the website, and Apple's own security documentation is blunt about it: "This public key is not a secret." On its own it cannot log anyone in.
- Nothing is transmitted that can be stolen. When you log in, your device proves it has the private key using cryptography, without sending the key itself. The server never learns what your private key is.
- Phishing is far harder. A passkey is tied to the exact domain it was created for. Microsoft's example: a passkey created for netflix.com can only be used with netflix.com, so if you are tricked onto a similar-looking site, your device will not offer the passkey at all.
- Your biometrics stay on your device. The website never receives your fingerprint or face data, only the cryptographic proof that your device approved the login.
Password alone
To log in
You type it.
Weak spot
It can be stolen through phishing, data breaches or malware, and people reuse it.
Password plus SMS or app code
To log in
You type the password, then look up a code.
Weak spot
GitHub's docs say SMS and TOTP codes can be phished.
Passkey
To log in
You confirm with Face ID, fingerprint or your device PIN.
Weak spot
Much harder to attack. It only works on the site it was made for, and there's nothing to hand over.
What logging in with a passkey looks like
In practice, using a passkey is very simple:
Go to the website's login page.
Choose the passkey option. Click "Sign in with passkey" or enter your username and select the passkey option.
Confirm it is you. Your device prompts you for Face ID, Touch ID, fingerprint, or your device PIN.
You're in. That's it.
No password to type. No 2FA code to look up. Fast and secure.
Where passkeys are stored
Passkeys sync through your device's ecosystem:
Passkeys on iPhone, iPad, and Mac are stored in iCloud Keychain, which syncs them across your Apple devices. To use passkeys at all, iCloud Keychain and two-factor authentication must be turned on for your Apple Account.
If you get a new iPhone, your passkeys come with it. You view and manage them in the Passwords app (iOS 18 and macOS Sequoia or later). On macOS Sonoma or earlier, they are in System Settings → Passwords and in Safari's settings instead.
Creating a passkey
When a site offers a passkey, you'll usually see the option during sign-up or in your account's security settings:
Log into your account using your existing password.
Open your security settings. Look for "Passkeys" or "Add a passkey."
Click to create a passkey. Your device will prompt you to verify with Face ID, fingerprint, or PIN.
The passkey is created and saved to your device automatically.
Do I still need a password after setting up a passkey?
It depends on the service. On GitHub, for example, a passkey replaces both the password and the second-factor step at sign-in (GitHub's docs say passkeys "satisfy both password and 2FA requirements, so you can complete your sign in with a single step") but the account still has a password behind it. Most services keep your password as a fallback in the same way.
Because that password is still there, you should still make it strong and unique. See How to create strong passwords.
Do passkeys replace 2FA?
Often, yes. The FIDO Alliance, which sets the passkey standards, says passkeys "leverage multiple factors for authentication": the passkey is on a device you have, and using it needs your fingerprint, face, or PIN. FIDO also says passkeys can replace older multi-factor setups such as a password plus an SMS code.
Two caveats. FIDO notes that "some regulatory regimes still have to evolve to recognize passkeys as one of the officially listed forms of multi-factor authentication", so if a rule you have to meet lists the methods it accepts, check it. And some high-security accounts still layer extra verification on top. Follow the recommendations of each service.
Common questions
What if I lose my phone: do I lose my passkeys?
If you use iCloud Keychain or Google Password Manager, passkeys are backed up to the cloud and restore when you sign into a new device. A third-party manager like 1Password also backs up passkeys. You should keep a backup method on each account (usually your existing password or a backup code) so you can still get in.
Can I use a passkey across different types of devices?
Yes, in a few ways. If you store passkeys in a cross-platform manager like 1Password or Bitwarden, they work on any device where that manager is installed. If you're on a device that doesn't have your passkey, the site can show a QR code that you scan with your phone to approve the login; a proximity check happens during that flow, so the phone has to be near the computer and a remote attacker cannot use it.
Are passkeys supported everywhere?
Not yet, but support keeps growing. Google, Apple, Microsoft, GitHub, and Shopify all support passkeys, and more services add them regularly. Plenty of smaller sites still offer only passwords, so you will be using both for a while.
Is this different from Face ID to unlock my phone?
Yes, but related. Face ID unlocking your phone is local. It just unlocks the device. A passkey uses Face ID (or another method) to prove your identity to an external website, using cryptography. Face ID is the gesture that triggers the passkey; the passkey is the actual login credential.
Related guides
Learn more
Was this page helpful?
Go deeper on chykalophia.com
- Our full guideWebsite maintenance: costs and risksWhat upkeep costs, and what goes wrong without it.
- Website careThe Boring StuffOur care plan: updates, backups, security and speed, looked after for you.
- Our approachWebsite optimizationTesting, performance work and analytics hygiene that keep your site earning.
Need a hand?
Stuck? We'll help.
Email us with your website address and a screenshot if you can, and we’ll take it from there.
Last updated