Passkeys Explained: A Simpler, Safer Way to Sign In

Passwords have been the standard way to sign in for decades, and they remain a weak point. People reuse them, forget them, and hand them to fake websites without realising. Passkeys are designed to fix these problems. They are supported by major platforms and a growing number of websites and apps, and they are worth understanding before you are asked to switch.

What is a passkey?

A passkey is a sign-in credential that replaces your password. Instead of typing a secret that you have to remember, you confirm your identity on your device using a fingerprint, face scan, or your device PIN. Passkeys are built on open standards known as FIDO2 and WebAuthn, which are backed by the FIDO Alliance and used by Apple, Google, and Microsoft.

How passkeys work

When you create a passkey for a website, your device generates a pair of cryptographic keys.

• The public key is sent to the website and stored on its servers.
• The private key stays on your device and is never shared with the website.

When you sign in, the website sends a challenge that only your private key can answer. Your device unlocks the key with your fingerprint, face, or PIN, signs the challenge, and sends back the result. The website checks it against your public key. Your biometric data never leaves your device.

Why passkeys are safer than passwords

• Resistant to phishing. A passkey is tied to the genuine website address. A fake site cannot use it, so there is nothing for you to be tricked into typing.
• Nothing useful to steal from the website. The site stores only the public key. If its database is breached, attackers do not gain a password they can reuse elsewhere.
• No reuse and no weak choices. Each passkey is unique to one site and cannot be guessed, so there is no habit of reusing passwords to avoid.
• Faster sign-in. A quick biometric check is usually quicker than typing a password and waiting for a code.

Where passkeys are stored

Passkeys can be saved in the platform's own credential manager, such as iCloud Keychain on Apple devices, Google Password Manager on Android and Chrome, or Microsoft's tools on Windows. Many password managers also support them. When a passkey is synced through one of these services, it is available on your other devices and can be recovered if you lose a phone. You can also use a phone to sign in on a nearby computer without saving anything on that computer.

How to start using passkeys

1. Check that your device is up to date. Recent versions of iOS, Android, Windows, macOS, and the main browsers support passkeys.
2. Look for the option in your account settings. Many services label it "Create a passkey" or "Sign in with a passkey" in their security settings.
3. Start with your most important accounts. Email, banking, and your main cloud account are good places to begin, since they protect the most.
4. Keep a recovery method. Make sure you can regain access if you lose a device, for example through account recovery options or a second device.

Limits to keep in mind

Not every website supports passkeys yet, so you will still use passwords in some places, and for those a unique password from a password manager remains the best option. Moving between different ecosystems, for example from one phone platform to another, can also be less smooth, although support for transferring passkeys is improving. Finally, a passkey is only as secure as the device and account that hold it, so protect your phone and your main account with a strong lock and two-step verification.

Final thoughts

Passkeys remove the most common weaknesses of passwords: weak choices, reuse, and phishing. Moving your key accounts to passkeys takes only a few minutes, and the result is both safer and easier to use. Start with your email and one or two critical accounts, keep a recovery method in place, and add more as the services you use offer support.