Passwords are familiar, but they can be reused, forgotten or entered on a fake website. Passkeys offer another way to sign in: a supported website or app verifies a cryptographic credential instead of asking you to type a password. Your device may ask you to unlock with a fingerprint, face recognition or screen-lock PIN; that unlock step does not mean the website receives your biometric data. This guide explains how passkeys work, how to set one up and how to plan for recovery. For background, see the FIDO Alliance’s passkeys overview.
What is a passkey?
A passkey is a digital credential that lets you sign in to a supported website or app without entering a traditional password. It relies on public-key cryptography. When you create a passkey, your authenticator creates a related key pair: a public key that the service stores and a private key that remains with your device or credential manager. During sign-in, the service sends a challenge and your authenticator proves it has the private key. The service verifies the response using the public key.
Your fingerprint, face scan or device PIN typically unlocks the authenticator locally; it is not normally sent to the website as your biometric data. Passkeys are associated with the service for which they were created, which helps protect against fake login pages.
How passkeys work
- You choose to create a passkey on a supported service.
- Your device or credential manager creates a cryptographic credential.
- The service stores the public key, not the private key.
- When you sign in, the service sends a challenge.
- You verify locally using a supported unlock method.
- The service checks the cryptographic response and signs you in.
This model is part of the FIDO/WebAuthn authentication ecosystem. It reduces common password risks, but does not make every possible account attack impossible.
Passkeys vs passwords
| Feature | Passkeys | Passwords |
|---|---|---|
| Sign-in | Cryptographic proof plus local verification | Enter a secret string |
| Phishing resistance | Designed to resist use on lookalike sites | Can be typed into a fake login page |
| Memorisation | Usually none required | Must be remembered or stored |
| Compatibility | Depends on service, device and credential provider | Widely supported |
| Recovery | Depends on synchronisation and account recovery | Usually password reset and other checks |
How to set up a passkey
1. Open the official account security settings
Visit the website directly or open its official app. Look for sections named Security, Sign-in methods, Passwordless login or Passkeys. Avoid configuring account security through unexpected email or text links.
2. Choose where to store it
Depending on the service, you may be able to use your device’s credential manager, a compatible password manager or a hardware security key. If you regularly switch between a phone and laptop, check how the passkey will be available on both devices.
3. Verify your identity
The service may ask for your current password, a verification code or another account check. Follow the on-screen instructions and approve the local verification prompt.
4. Save and test the passkey
Give it a recognisable name if offered. Then check the account’s security settings to confirm it appears. When practical, test sign-in in a separate browser session before relying on it.
Using a passkey on another device
If your credential provider synchronises passkeys, the credential may be available on another compatible device after you sign in to the same provider. Some services also support cross-device authentication: a computer may show a QR code that you scan with a nearby phone containing the passkey. Follow the service’s instructions and confirm that both devices meet its requirements. A passkey stored only on a particular device or hardware key may not automatically synchronise.
What if you lose your phone?
- Check another trusted device: a synchronised passkey may already be available on your laptop or tablet.
- Use official account recovery: the service may offer recovery email, verified phone, backup codes or another method.
- Secure the lost device: use the platform’s official device-locking or device-finding tools where available.
- Review active sessions: sign out the lost device from important accounts if possible.
- Revoke the lost credential: once you regain access, remove passkeys associated with devices you no longer control.
- Create and test a replacement: add a new passkey on a trusted device.
If the only copy was stored on the lost device, access may depend on the website’s recovery process. A passkey does not remove the need to plan recovery.
Are passkeys safe?
Passkeys offer strong protection against phishing and password replay. Still, compromised devices, malware, a weak recovery process or social engineering can create risk. Use a strong device PIN, install security updates, protect your primary email account and review recovery methods. See our guide to data privacy rules every smartphone user should know and protecting an Android phone from banking fraud.
Common problems and fixes
Passkey option missing: the service, account or app version may not support it. Check the official help page and update compatible software.
Passkey not found on a new device: confirm you are using the correct credential provider and that synchronisation is enabled where supported. If it was device-bound, use official recovery.
Cross-device sign-in fails: keep the devices nearby and follow QR or pairing instructions. Enable Bluetooth or other required features if prompted.
Recovery does not work: use the service’s official recovery page. Never give passwords or one-time codes to third parties who promise to recover an account.
Frequently asked questions
Are passkeys completely password-free?
They can provide passwordless sign-in on supported services, but a service may still ask for a password or another verification method in some recovery or account-change situations.
Does a passkey send my fingerprint to a website?
Biometric verification is generally handled locally by the device. The website receives an authentication result, not the fingerprint itself.
Can one passkey work on every website?
No. Passkeys are associated with specific services, so you may have separate credentials for different accounts.
Should I delete all my passwords after setting up a passkey?
No. Keep recovery methods available and confirm that your important accounts support reliable passkey sign-in before changing your normal setup.
Are passkeys better than two-factor authentication?
Passkeys can provide phishing-resistant authentication and may combine device possession with local verification. Follow the service’s recommended security configuration because implementations and recovery methods differ.
Final verdict
Passkeys make signing in simpler while reducing several risks associated with passwords. Start with one important account, create a passkey through its official security settings, test it and review recovery options. Then enable passkeys on other supported accounts at your own pace. Always verify service-specific instructions against current official documentation before making security changes.