What Passkeys Are and How They Replace Passwords

A sign-in with nothing to type

A passkey is a way to sign in to a website or app without entering a password. Instead, your device proves it holds a secret key, after you confirm with your fingerprint, face or screen lock. You may already have seen the prompt: “Sign in with a passkey” followed by a quick biometric check.

Passkeys are built on an industry standard that major device makers, browsers and many websites have adopted, though support varies by service. They are meant to address problems with passwords: people reuse them, choose weak ones, and get fooled into typing them into fake sites.

How it works

Passkeys use a pair of keys. This is the same principle explained in public key cryptography.

1. When you create a passkey for a site, your device generates two mathematically linked keys.
2. The public key goes to the website, which stores it with your account. It is not a secret, so stealing it from the website is of little use.
3. The private key stays on your device (or in a protected sync service, discussed below). It is never sent to the website.
4. When you sign in, the website sends a one-time challenge. Your device signs the challenge with the private key after you approve with a biometric or PIN.
5. The website checks the signature using the public key. If it matches, you are in.

Notice what is absent: no password crosses the internet and the website has nothing secret to lose. If the site suffers one of the data breaches that are so common, attackers get only public keys, which cannot be used to sign in.

Your fingerprint or face data is typically used only to unlock the key on your device. It is not sent to the website. Biometric data is generally handled by the device’s secure hardware, though how this works varies by product.

Why they are harder to trick

A passkey is tied to the website address it was created for. If you land on a look-alike page with a different address, your device will not offer the passkey, because it does not match. This means that a fake site cannot easily capture it the way it can capture a typed password. That is a big difference from phishing emails that send people to convincing fake login pages.

Passkeys also cannot be reused across sites, guessed, or leaked from a database in a usable form. And since signing in takes one approval, they are often faster than typing a password plus a code.

Where the keys live

Passkeys can be stored in a few ways:

• On one device, such as a phone, where the key never leaves.
• Synced through an account, such as your phone or computer maker’s cloud service, or a password manager that supports passkeys. Syncing makes passkeys available on your other devices and helps if you replace a phone. The synced copies are encrypted, though the exact protections depend on the provider.
• On a hardware security key, a small physical device.

You can often sign in on a computer by scanning a code with your phone, which lets you use a passkey stored there without transferring it.

Practical questions

What if I lose my phone? If your passkeys are synced to your account, you can usually recover them on a new device after signing in to that account, which makes the security of the account itself important. Services also keep other recovery methods, so it helps to set up and understand them in advance.

Do I still need a password? For now, often yes. Many sites let you add a passkey alongside your existing password rather than removing the password. As long as a password remains active, it can still be attacked, so keep it strong and unique, and keep two-factor authentication on where the site offers it.

Is it two-factor already? A passkey generally combines something you have (the device) with something you are or know (the biometric or PIN), so many services treat it as a strong sign-in on its own. Policies vary.

What if someone steals my unlocked phone? A passkey is only as safe as the device protecting it. A strong screen lock and updated software remain essential.

Can I use them with a shared or work computer? Be careful about saving passkeys on devices you do not own. Choose the option to use your phone instead.

Getting started

1. Make sure your devices are updated, since passkey support depends on recent software.
2. Look in the security settings of your important accounts, such as email, for an option to create a passkey.
3. Check where it will be stored and whether it syncs, and decide whether that suits you.
4. Keep a recovery method available.
5. Add passkeys gradually, because not every site supports them yet.

Passkeys will probably sit alongside passwords for some time. Even so, using them where they are available removes one of the most common ways accounts get stolen.