Passkeys, explained: why your passwords are on their way out
Passkeys let you sign in with your fingerprint, face or phone PIN instead of a password, and they can't be phished. How they work and how to start.
If you’ve recently been asked to “create a passkey” when signing in to Google, Apple, Microsoft, Amazon or your bank, you’ve met the technology designed to replace passwords. This guide explains what it is and why you should say yes.
The problem with passwords
Passwords fail in predictable ways:
- People reuse them, so one leaked site exposes many accounts.
- They get phished: a fake login page steals them.
- They get guessed or cracked when they’re weak.
Most account takeovers begin with one of these.
What a passkey is
A passkey is a pair of cryptographic keys created for one account on one website:
- A private key stays on your device (or in your password manager), protected by your fingerprint, face or device PIN.
- A public key is stored by the website.
When you sign in, the site sends a challenge. Your device proves it has the private key by signing the challenge, after you unlock it with your fingerprint, face or PIN. The private key never leaves your device and is never sent to the website.
Why passkeys are safer
- Nothing to steal from the server. A website breach exposes only public keys, which are useless to attackers.
- Phishing-resistant. A passkey is bound to the real website’s address. A lookalike phishing site can’t trigger it.
- Nothing to remember or reuse. Every passkey is unique by design.
Is my fingerprint sent to the website?
No. Your fingerprint or face only unlocks the passkey on your own device. The website never sees your biometrics.
What if I lose my phone?
Passkeys are usually synced through your platform account (such as iCloud Keychain or Google Password Manager) or a third-party password manager, so they come back when you sign in on a new device. Keep your account recovery options up to date, and it’s wise to keep a second sign-in method, such as a backup passkey on another device.
How to start
- Pick an important account that supports passkeys, such as your email.
- Go to its security settings and look for Passkeys or Sign-in methods.
- Choose Create a passkey and confirm with your fingerprint, face or PIN.
- Next time you sign in, choose the passkey option.
Start with your email account: it’s the key to resetting every other password you have.
Should I delete my passwords?
Not yet. Many sites still keep a password as a fallback. Keep strong, unique passwords (a password manager makes this painless) and add passkeys wherever they’re offered. Over time, you’ll type fewer and fewer passwords.
