What Are Passkeys and How Do They Work? A Beginner’s Guide

A passkey is a passwordless login method that uses a pair of cryptographic keys instead of a typed secret. You approve the sign-in with your fingerprint, face, or device PIN, and there is no password to steal, guess, or reuse.

Passkeys are built on open standards known as WebAuthn and FIDO, and they are supported by a growing number of websites, browsers, and operating systems.

The idea in plain language

When you create a passkey for a website, your device generates two linked keys:

• A public key, which is sent to the website and stored there.
• A private key, which stays on your device and never leaves it in readable form.

When you sign in, the website sends a challenge. Your device signs that challenge with the private key after you confirm with your fingerprint, face, or PIN. The site checks the signature with the public key. No secret is sent across the internet.

This matters because a site’s stored public key is useless to an attacker. If the website is breached, there is no password database to crack.

Why passkeys resist phishing

Each passkey is tied to the exact website address it was created for. If you land on a fake page with a lookalike address, your device simply has no matching passkey to offer. Unlike passwords, you cannot be talked into typing a passkey into the wrong place.

That is a real improvement, because phishing is one of the most common ways accounts are taken over.

Where passkeys are stored

There are two main models:

• Device-bound passkeys: stored on one device or hardware key. They do not move, which is secure but less convenient.
• Synced passkeys: stored in an account-based vault, such as your device ecosystem’s keychain or a password manager, and available across your devices after you sign in.

Synced passkeys are easier to recover when you lose a phone. Their security then depends on how well you protect the sync account, so use a strong password and two-factor authentication there.

What signing in looks like

1. Go to the login page and choose to sign in with a passkey, or select your account name.
2. Your device prompts for biometrics or your PIN.
3. You are logged in.

Signing in from a different device is possible too. Many systems let you scan a QR code with your phone and approve there.

Setting up your first passkey

1. Choose an account that supports passkeys, such as your main email or a major service.
2. Open the security settings and look for passkey or passwordless options.
3. Follow the prompts to create the passkey and name it so you recognize it later.
4. Keep your password and another recovery method for now, in case a device is lost.
5. Test signing in from a fresh session.

Limits and things to know

• Not every site supports passkeys yet, so you will still need passwords elsewhere.
• Account recovery remains a weak point on some services. An attacker who can pass the recovery process might bypass a passkey, so secure recovery options.
• Sharing accounts is awkward when each person signs in with a personal device.
• Mixed ecosystems can complicate syncing between different device makers, although compatibility is improving.

Do passkeys count as two-factor?

In practice, yes. A passkey proves you possess the device that holds the key and that you passed a local check, such as biometrics or a PIN. Biometric data stays on the device and is not sent to the site.

Passkeys and shared devices

Be careful on devices you do not own or that other people use. A passkey stored on a shared computer might be available to others who can unlock it. Use a personal device when possible, or the cross-device QR sign-in feature, which lets your own phone approve the login without storing anything on the shared machine. If you must use a public computer, sign out fully and never allow the browser to remember you.

What to do when you sell or replace a device

Before you hand over an old phone or laptop, remove its passkeys from your account settings, sign out of your sync account, and wipe the device. Then confirm in each account’s security page that the old device is no longer listed as trusted.

Passkeys in everyday words

Think of a passkey as a lock and key where the website holds only the lock. The key never leaves your device, and it only turns when you prove you are present. Because the website never receives a reusable secret, there is nothing for a phisher to copy and nothing valuable to leak from a database.

Frequently asked questions

What happens if I lose the phone with my passkeys?

If they are synced, you can sign in to your account vault on a new device and recover them. If they are device-bound, use your backup method and set up new passkeys.

Are passkeys safer than passwords?

Generally yes, mostly because they cannot be phished or reused and leave nothing useful in a website breach. They are not magic, so protect your devices and recovery options.

Do I still need a password manager?

Probably. Many accounts will still use passwords for years, and some managers can also store passkeys.

Key takeaways

• Passkeys use public-key cryptography, so no shared secret travels or sits on a server.
• They are bound to the real website, which blocks phishing.
• Keep recovery methods in place while you transition.
• Secure the account or device that syncs your passkeys.