TL;DR: Passkeys let you sign in with your fingerprint, face or device PIN instead of a password. They are built on open standards from the FIDO Alliance, they can’t be phished the way passwords can, and Google, Apple and Microsoft all support them. This guide explains how passkeys work and walks through setting them up on your Google, Apple and Microsoft accounts, plus what to do if you lose a device.
What is a passkey?
A passkey is a digital credential that replaces a password. When you create one for a website or app, your device generates a pair of cryptographic keys. The public key is stored by the service. The private key stays on your device or in your password manager, protected by your screen lock. When you sign in, your device proves it holds the private key, and you approve with a fingerprint, face scan or PIN.
The FIDO Alliance, the industry group behind the standard, describes passkeys as faster, easier and more secure than passwords. The big advantages are practical:
- Nothing to remember or reuse. Each passkey is unique to one service.
- Phishing resistant. A passkey only works on the real website it was created for, so a lookalike scam site can’t trick you into handing it over.
- Nothing useful to steal from servers. Services store only your public key, which is useless to an attacker on its own.
- Faster sign-in. A glance or a touch replaces typing a password and waiting for a code.
Passwords vs. passkeys at a glance
| Password | Passkey | |
|---|---|---|
| What you provide | Something you remember and type | Biometric or device PIN approval |
| Can be phished | Yes | Designed to resist phishing |
| Can be reused across sites | Often, unfortunately | No, each one is unique |
| Leaked in a server breach | Possible | Only the public key is stored |
| Syncs across devices | Via password manager | Via your platform account or password manager |
Before you start
- Update your phone, tablet and computer to a recent operating system version.
- Make sure your device has a screen lock (PIN, password, fingerprint or face unlock) turned on.
- Decide where your passkeys will live: Google Password Manager, Apple’s iCloud Keychain and Passwords app, Windows, or a third-party password manager that supports passkeys.
How to set up a passkey for your Google Account
Google supports passkeys for personal Google Accounts and explains the process on its Google Account Help page.
- Go to your Google Account and open the Security section.
- Find Passkeys and security keys under the sign-in options.
- Select Create a passkey and follow the prompts.
- Confirm with your fingerprint, face or screen lock.
On Android phones signed in to your account, Google may create a passkey automatically. You can view and remove passkeys from the same settings page.
How to use passkeys on iPhone, iPad and Mac
Apple stores passkeys in iCloud Keychain, and they sync across your Apple devices through your Apple Account. Apple’s guide to using passkeys on iPhone covers the steps.
- Turn on iCloud Keychain in Settings under your name, then iCloud, then Passwords and Keychain.
- Visit a website or app that supports passkeys and choose to create one, usually in its account or security settings.
- Approve with Face ID or Touch ID. The passkey is saved automatically.
- Manage saved passkeys in Apple’s Passwords app.
Apple publishes a detailed explanation of how passkeys are secured, including end-to-end encryption of synced keys.
How to set up a passkey for your Microsoft account and Windows
Microsoft supports passkeys for Microsoft accounts and in Windows through Windows Hello. Its passkeys in Windows support page explains the options.
- Sign in to your Microsoft account online and open the Security settings.
- Look for the option to manage how you sign in and add a new sign-in method or passkey.
- Choose where to store it: this Windows device, a phone, or a security key.
- Confirm with Windows Hello (face, fingerprint or PIN) or your phone.
Menu labels change from time to time, so if a step looks slightly different, follow the closest matching option in the security settings.
Signing in on a device that doesn’t have your passkey
If you are on a borrowed or new computer, choose the option to use a passkey from another device. The computer will show a QR code. Scan it with your phone, approve with your fingerprint or face, and the phone vouches for you over a short-range Bluetooth check. Your passkey itself never leaves your phone.
What if you lose your phone?
Synced passkeys are backed up to your Google, Apple or password manager account, so signing in on a replacement device restores them. Still, plan for recovery:
- Keep at least two trusted devices or a hardware security key registered for important accounts.
- Keep recovery codes and recovery contact details up to date.
- Do not delete your password straight away for critical accounts until you are confident in your passkey setup.
Common questions
Does my fingerprint get sent to the website?
No. Biometric checks happen on your device. The website only receives cryptographic proof that you approved the sign-in.
Can I use passkeys in a third-party password manager?
Yes. Many password managers now store and sync passkeys, which helps if you use a mix of Apple, Android and Windows devices.
Do all websites support passkeys?
Not yet, but support is growing quickly among major services. Look for passkey options in each account’s security settings.
The bottom line
Passkeys are the most meaningful upgrade to everyday account security in years. They are easier than passwords and far harder to phish. Start with your most important accounts, usually email and your Google, Apple or Microsoft account, then add passkeys to other services as they offer them.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
