What is a passkey and should you use one

I turned off my Google account password in March. Not disabled the account, disabled the password itself, replaced it with Face ID on my phone. Six months later I still remember the old password by accident, it’s muscle memory at this point, but I haven’t typed it anywhere, because there’s nowhere left to type it.

That’s what a passkey does.

It’s not a stronger password, it’s the thing that makes a password unnecessary for that account. If you’ve seen “sign in with a passkey” pop up on Google, Amazon, PayPal, or your bank’s app recently and skipped past it because you weren’t sure what you were agreeing to, this is the explainer.

what it is

A passkey is a cryptographic key pair, generated on your device, that replaces a username-and-password login. One half of the pair, the private key, never leaves your phone, laptop, or security key. The other half, the public key, sits on the website’s server. When you sign in, your device proves it holds the private key without ever sending it anywhere, so there’s no password sitting in a database for a hacker to steal in the first place.

The standard behind this is called WebAuthn, built by the W3C alongside the FIDO Alliance, an industry group that includes Google, Apple, Microsoft, Amazon and most major banks. Passkeys aren’t one company’s product bolted onto a login page. Apple, Google and Microsoft all implement the same spec, which is why a passkey created on your iPhone can, in a lot of cases, be used to sign into a website on a Windows laptop.

how it works

Setting one up looks almost identical across sites: you go to account security settings, tap “create a passkey,” and your device asks you to confirm with Face ID, Touch ID, Windows Hello, or a PIN. That confirmation happens locally. Your fingerprint or face never gets uploaded anywhere, it just unlocks the private key stored in your device’s secure hardware chip.

Signing in afterward is the same flow in reverse. You tap the username field, your device offers the saved passkey, you confirm with biometrics, and you’re in. No typing, no password manager autofill, no “which of my 40 password variants did I use for this site” moment.

The private key is tied to the site’s domain, and that’s the part that quietly kills phishing. A fake login page at “paypa1.com” can’t request your PayPal passkey, because the passkey only responds to requests from the real paypal.com domain. Compare that to a password, which you can be tricked into typing into any page that looks convincing enough.

Passkeys sync across your devices through whatever platform you’re on: iCloud Keychain for Apple devices, Google Password Manager for Android and Chrome, Windows Hello for Microsoft accounts. Lose your phone and your passkeys are still recoverable through that sync, same as your photos or contacts would be.

why it matters

Credential theft is still the biggest door into most accounts. I don’t have this year’s breach numbers memorized and I’m not going to fake one, but the pattern hasn’t moved in a decade: stolen or reused passwords keep showing up as the initial entry point in major breach reports, and phishing kits built to harvest passwords are cheap and everywhere. Passkeys remove the exact thing those kits are designed to steal.

A few concrete reasons this is worth your time:

• phishing resistance: there’s no password to type into a fake page, and no OTP code to read out to a scammer on the phone, which is the exact scenario that’s drained crypto wallets and business email accounts for years
• fewer resets: I stopped getting “forgot password” emails from Google entirely, which sounds small until you remember how many reset flows are themselves an attack vector, reset-link interception, SIM-swap based SMS codes
• less reuse pressure: you’re not choosing a password at all, so the “I’ll just reuse my Netflix password” habit doesn’t get a chance to happen on that account
• a stolen device isn’t a stolen credential: someone who grabs your phone still has to get past Face ID or your PIN before a passkey does anything for them, versus a leaked password database that works from anywhere on earth

Google’s security team has been fairly vocal about passkeys cutting down account takeover attempts on accounts that enable them. You can read their own framing on it on their passkey overview page, I haven’t independently audited their numbers so treat that as the vendor’s own claim, not mine.

common misconceptions

“Passkeys are just a fancier password manager.” No. A password manager still stores a secret that can, in theory, be phished, guessed, or leaked in a breach somewhere down the chain. A passkey has no secret that can be typed or intercepted in transit. The private key never leaves your device, full stop.

“If I lose my phone, I lose access to everything.” Not if sync is on. Apple, Google and Microsoft all back up passkeys to their respective cloud keychains, recoverable on a new device once you sign back into that ecosystem. The real risk is losing access to the account that holds your sync, your Apple ID or Google account, without a recovery method set up on that account. That’s a genuine risk. It’s just not the one people usually picture.

“Passkeys are only for tech companies, my bank doesn’t support this.” A growing list does. PayPal, eBay, and a number of Singapore and US banks have rolled out passkey support over the last couple of years. If your bank’s app doesn’t offer it yet, check again in six months, this is moving faster than most authentication rollouts I’ve watched over the years.

“They replace two-factor authentication, so I don’t need 2FA anymore.” Sort of backwards. A passkey already does what 2FA was bolted onto passwords to achieve, combining “something you have” (the device) with “something you are” (your biometric unlock) into one step instead of two. The US government’s own guidance on authenticator strength, NIST SP 800-63B, specifically calls out phishing-resistant authenticators as the strongest tier available, and passkeys are the mechanism that gets you there. You’re not weakening anything by using a passkey instead of password-plus-2FA. You’re collapsing two weaker factors into one stronger one.

where to go from here

Should you use one? Yes, on any account that offers it, starting with your email and your password manager account, since those two are what an attacker uses to pivot into everything else. I’d rank Google, Apple ID and Microsoft accounts first, then your bank, then whatever else rolls it out over time. I wouldn’t bother setting one up for a forum login you use twice a year, the friction isn’t worth it for an account with nothing in it.

The honest caveat: not every site supports passkeys yet, and cross-platform handoff still has rough edges. I’ve had a passkey created on my Mac fail to show up cleanly when I tried to use it from a Windows machine at a client’s office, ended up falling back to a QR-code prompt that worked but wasn’t nearly as smooth as the marketing suggests. It’s not a solved problem everywhere. It’s a very good one wherever it’s implemented properly.

A few things worth reading next if you’re going down this path. If you haven’t set up a password manager yet, that’s still the right move for every account that doesn’t support passkeys. If the difference between a passkey and two-factor authentication still isn’t clear, that’s worth untangling before you decide what to turn off. And if browser fingerprinting or account-level identity isolation is on your radar too, antidetectreview.org covers that side of the security picture in more depth than fits here.

For the rest of the explainers in this series, the blog index has the full list.

Written by Xavier Fok

disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-08-20.