What Is a Passkey? How It Differs from a Password, and How to Set One Up
Plenty of people have seen a sign-in screen ask "Create a passkey?" and simply closed it. This guide explains how a passkey differs from a password, why it stands up to phishing, how to set one up, and what to watch out for when you switch phones.
What is a passkey?
A passkey is a key you use to sign in instead of a password. When you create one, a "private key" is stored on your device and a "public key" is stored by the service. Each time you sign in, the service sends some data, your device signs it with the private key, and the service checks that signature with the public key. The private key itself never leaves your device.
From your side, all you do is unlock with your face, fingerprint or screen lock. There's nothing to type, so there's nothing to remember or write down. Biometrics are only used to unlock your device; your face or fingerprint data is never sent to the service.
How passkeys differ from passwords and two-factor authentication
| Password | Password + two-factor | Passkey | |
|---|---|---|---|
| What you remember | A string | A string + confirming a code | Nothing |
| If data leaks | It can be used as is | Often stopped by the code | The server's data alone can't sign anyone in |
| Fake sites | Stolen when you type it | Codes have been phished too | Doesn't work on a different domain |
| Reuse | Common | Common | Can't happen (a separate key per service) |
| Effort to sign in | Typing | Typing + a code | Just unlocking |
The row to focus on is "Fake sites". Even with two-factor authentication turned on, you can still be compromised if you're lured to a fake site and type in the code as well. A passkey is tied to the domain of the site where you registered it, so it won't work on a lookalike page on a different domain. Even when a person can't tell the difference, the mechanism stops it. That's the decisive difference.
Why passkeys stand up to phishing
- Tied to the registered domain: on a fake site's domain, the passkey isn't even offered
- The private key is never sent: even if traffic is intercepted, all that passes is a signature that's different every time
- No secret is stored on the server: even if the service is breached, the public key can't be used to sign in
- Reuse is structurally impossible: a separate key is created for each service
- It doesn't rely on your judgment: even if you can't spot a bad URL, it won't work unless the conditions match
Most password incidents start with "I typed it in". A phishing email leads to a fake sign-in page, and you enter your details out of habit. A passkey removes the act of typing altogether. By shrinking the room for slip-ups, it's more reliable than measures that depend on staying alert.
How to set up a passkey
- 1
Check whether the service supports passkeys
Look in the security section of your account settings for an option like "Passkeys" or "Sign in without a password". If there isn't one, the service doesn't support them yet.
- 2
Decide where to save it
Choose whether to save it on the device or in a password manager. If you use several devices, picking one that syncs will make life easier later.
- 3
Create it and verify
Follow the on-screen steps and verify with your face, fingerprint or PIN. This is when the private key is saved on your device.
- 4
Sign in again right away to test it
Sign out once and check that you can sign back in with the passkey. If you set it up without testing, you won't find out it doesn't work until you need it.
- 5
Keep your password and recovery options
In case your passkey isn't available, keep your existing password and backup codes rather than deleting them.
Don't skip the last step. If you lose the device with your passkey and haven't kept a password or recovery codes, you'll be locked out of the account. A passkey makes everyday sign-in easier; it doesn't replace your recovery options.
Where are passkeys stored?
| Where it's saved | Characteristics | Good for |
|---|---|---|
| On the device only | Never leaves that device. The strongest option | People who use a single device |
| Your OS's sync (such as iCloud Keychain or Google Password Manager) | Shared across devices signed in to the same account | People whose devices are all from the same maker |
| A password manager | Works across operating systems | People with a mix, such as an iPhone and a Windows PC |
| A security key | Carried around as a physical key | Workplaces that need strict controls |
If your phone and computer come from different makers, saving passkeys in a password manager keeps things simple. If it syncs, a passkey created on your computer also works on your phone. If you choose a setup that doesn't sync, you'll need to add a passkey separately on each device.
What to know before you start
- Don't create passkeys on shared devices: on a family computer, anyone who can unlock the screen can sign in
- Check before switching phones: if your passkeys don't sync, add them to the new device before giving up the old one
- Follow the rules on work devices: work accounts may be restricted by an administrator's settings
- Support varies by service: the same service may behave differently in its app and on the web
- Don't leave a weak password in place: as long as you use both, the password is the way in
The last point is easy to overlook. Even with a passkey set up, if the account still has an old, short password, attackers will go after that instead. While you use both, update the password to something long enough too. A password generator can create hard-to-guess strings in bulk with the length and character types you choose, and generation happens entirely in your browser with nothing sent to a server. How to choose the password you keep alongside is covered in how to create a strong password, and which sign-in methods to use on services without passkey support is covered in which two-factor method to choose.
FAQ
- What's the difference between a passkey and a password?
- A password works by you and the service sharing the same string, so anyone who gets it can sign in. A passkey puts a private key on your device and a public key with the service, and the private key never leaves your device. Leaked server data can't be used to sign in, and since a passkey only works on the domain it was registered for, you can't be tricked into entering it on a fake site.
- What happens if I lose the device my passkey is on?
- If you saved it somewhere that syncs (your OS's sync or a password manager), you can use the same passkey on a new device. If it was stored on that device only, it's gone, so you'll need to sign in with another recovery option, such as your password or backup codes, and create a new passkey on the new device. That's why you should keep those recovery options.
- Does a passkey send my biometric data to the service?
- No. Face or fingerprint recognition is only used to unlock your device so the private key can be used. All the service receives is a signature made with that key. Your biometric data stays on your device.
- Once I have a passkey, can I delete my password?
- Not yet. There are still screens that don't support passkeys and situations where your passkey won't be available. Keep the password as a recovery option, and while you use both, update it to a long one. If a service later lets you remove the password, check that you have other recovery options in place before deciding.
Tools in this article
Related articles
How to Manage Your Passwords: Choosing Where to Store Them and How to Switch
Everyone says to use a different password for every account, but you can't remember them all, so you end up reusing them. The problem isn't the passwords themselves — it's where you keep them. This guide compares the ways to store passwords, what each is good and bad at, and the steps to move from where you are now to a safer setup.
Read article →What Is Two-Factor Authentication? Which Accounts to Secure First and How Strong Each Method Is
Even if your password leaks, two-factor authentication stops most unauthorized logins. This guide covers how strong each authentication method is, which services to set it up on first, and how to keep backups so you don’t get locked out when you change phones.
Read article →How to Create a Strong Password: Length, Character Types, and Management
Many people assume that adding symbols makes a password safe, but the biggest factor in password strength is length, not character types. This guide compares the real number of combinations, lists the patterns to avoid, and covers how to manage passwords once you have created them.
Read article →