On this page
A passkey lets you sign in without typing a password for that account. Instead, you approve the login with your device's fingerprint reader, face recognition, PIN, or another screen-unlock method. The website receives proof of approval, not your fingerprint.
The biggest benefit is not just convenience. Passkeys are tied to the real website or app, so an ordinary fake login page cannot collect a reusable secret the way it can steal a password.
Understand what a passkey actually does
When you create a passkey, your device or credential provider creates a pair of cryptographic keys. The service stores a public key. The private key stays with your passkey provider, device, or security key rather than being shared with the website.
At sign-in, the service sends a challenge. Your passkey signs it after you approve the request, and the service checks that signature with the public key. You do not need to understand the mathematics to use it.
Your face or fingerprint normally unlocks the credential locally. The website does not receive your biometric data. A device PIN can serve the same local approval role when supported; it is not automatically your account's online password.
Passkeys resist typical credential phishing because the authentication is bound to the correct service. They do not prevent every scam, malicious app, stolen session, or mistaken payment. Keep checking what you are approving, especially on a shared or potentially compromised device.
Know where your passkey lives
Some passkeys sync through a credential manager, such as Apple Passwords, Google Password Manager, or another compatible password manager. Others remain tied to a particular device or physical security key.
A synced passkey can be available across devices signed into the same supported provider account. That convenience makes protecting the provider account and its recovery process especially important.
A device-bound passkey does not automatically appear on a replacement phone or computer. A hardware security key is portable because you physically carry it, but losing that key can remove your access unless you have another method.
Before choosing where to save a passkey, ask three questions:
- Availability: Will this provider work on the devices and browsers you actually use?
- Recovery: What happens if you lose your phone or cannot unlock your credential manager?
- Backup: Can you register another passkey or keep a separate recovery method?
Do not assume every passkey transfers between competing providers. Transfer support varies, and you may need to create another passkey while you can still sign in.
Set up your first passkey
Start with an account you use regularly on a personal device. Update the operating system and browser first, and make sure a secure screen lock is enabled.
- Open the service's official app or website and sign in normally.
- Go to account settings, then look for Security, Sign-in methods, or Passkeys.
- Choose Create a passkey or Add a passkey.
- Read the system prompt to see which provider or device will save it.
- Approve with your fingerprint, face, PIN, or security key.
- Test the passkey in a separate sign-in before removing any existing method.
The exact wording varies by service. Some offer a passkey during a routine login rather than inside a dedicated security page. Check the account address and system prompt before accepting.
iPhone and Android
On iPhone, review saved credentials in the Passwords app on supported versions. On Android, look in Google Password Manager or your selected credential manager. Settings search can help locate passkey and autofill controls when manufacturers arrange menus differently.
Windows and Mac
On supported Windows versions, Settings > Accounts > Passkeys can show locally managed passkeys. Synced credentials may instead be managed through your chosen provider. On Mac, use the Passwords app where available or your selected password manager.
Sign in across devices safely
When a computer does not have your passkey, a website may offer to use a phone or another device. This can display a QR code that you scan with your phone, followed by an approval prompt.
That QR code starts a specific authentication flow. It is not something you should save, share, or reuse. Cross-device sign-in commonly requires the devices to be nearby, with Bluetooth enabled to help establish proximity, along with working connectivity.
Only start this process from a login you initiated at the legitimate service. Do not scan an unsolicited code from an email or approve a request because someone on the phone tells you to.
On a borrowed computer, avoid saving credentials or creating a passkey in the other person's account. Sign out when finished. If the computer might be compromised, using your own device is safer than relying on any sign-in method to protect the entire session.
Plan for a lost phone before it happens
Losing a device does not always mean losing a synced passkey. Recovery depends on the credential provider, your other devices, and the security protections you enabled.
Register a second passkey when the service allows it, ideally using an independently accessible device or security key. Save service recovery codes somewhere secure that does not depend entirely on the account they recover.
Keep recovery phone numbers and backup email addresses current. Protect the account that syncs your passkeys with strong authentication, and learn its recovery requirements before you need them.
If a service still requires a fallback password, make that password unique. The Password & Hash Generator can help create one; store it in a trusted password manager rather than trying to memorize a complicated string.
For accounts that do not support passkeys, follow How to Turn On Two-Factor Authentication Everywhere. A strong fallback matters because attackers may target recovery instead of the passkey itself.
Troubleshoot without deleting your backup
If no passkey appears, check that you selected the correct account, browser profile, and credential provider. A work profile and personal profile may hold different credentials. Confirm that syncing is enabled if you expect a synced passkey.
If cross-device sign-in stalls, check Bluetooth, connectivity, and on-screen instructions. Then try signing in directly on the phone or using an existing recovery method. Do not repeatedly approve unexplained prompts.
When replacing a device, test sign-in on the replacement before wiping the old one. If you lose access entirely, use the service's official recovery flow. What to Do If Your Email Account Is Hacked covers additional steps when unexpected access is involved.
Start with one well-protected account
Passkeys can remove both typing and a common phishing weakness. Create one on a trusted device, understand where it is stored, and keep a tested recovery route. Expand to other accounts once that first setup feels familiar.
Reach designers & developers at work
Put your product next to the tools people use every day. One sponsor per placement, no tracking pixels.
Become a sponsor