Passkeys: The Password-Free Way to Sign In
Passkeys let you sign in with your fingerprint or face instead of a password, and they're resistant to phishing by design. Here's how they work and how to start using them.
A passkey↗ is a modern way to sign in that replaces your password. Instead of typing something you know, you confirm it is you with your phone or computer and your fingerprint, face, or device PIN, the same way you already unlock your device. There is nothing to remember and nothing to type.
Passwords and passkeys compared
| Password | Passkey | |
|---|---|---|
| What you do | Type a secret you remember | Confirm with fingerprint, face, or device PIN |
| If the website is breached | Your password may be exposed and can be used elsewhere if you reused it | The website holds nothing an attacker can use to sign in as you |
| Fake login pages | You can be tricked into typing it | The passkey will not work on a fake site |
| Reuse across sites | Common, and risky | Not possible: each site gets its own |
| Guessing | Weak passwords can be guessed | There is nothing to guess |
Why passkeys are safer
Passkeys use public-key cryptography↗. That sounds technical, but the idea is simple. When you set one up, your device creates two matching keys, like a padlock and its key:
- The website keeps the public key. It is like an open padlock: useless to a thief on its own.
- The private key stays protected by your device or your passkey manager and is never sent to the website. It is the only thing that can "close" the padlock correctly.
To sign in, the website sends a challenge, and your device answers it using the private key after you confirm with your fingerprint, face, or PIN. No secret travels over the internet, and nothing stored on the website's servers can be stolen and reused to sign in as you.
This also makes passkeys phishing↗-resistant. Phishing means tricking you into giving your login to a fake page. A fake page can trick you into typing a password, but it cannot trick your device into using a passkey that belongs to a different, genuine site. The passkey simply will not work there.
How signing in feels
- Go to a website or app that supports passkeys and choose "sign in with a passkey". Some offer it automatically.
- Your device asks you to confirm with your fingerprint, face, or device PIN.
- You are signed in. No password to type and no code to copy from a text message.
Setting up your first passkey
Support is growing quickly across major platforms. A good first step is your main email account, because it is the key to your other accounts:
- Google Account: Settings → Security → "How you sign in to Google" → Passkeys.
- Apple ID: passkeys are built in via iCloud Keychain on modern iPhones and Macs.
- Microsoft Account: account.microsoft.com → Security → Advanced security options → Passkeys.
Menu names change over time. If you cannot find the option, search the account's security settings for "passkey".
Many passkeys sync through your own cloud account (Apple, Google, or a password manager↗ that supports passkeys), so getting a new phone does not lock you out.
What if I lose my device?
If your passkeys sync through your account, signing in to a new device with the same account usually brings them back. Still keep at least one backup↗ way to sign in, such as a recovery code stored somewhere safe, for important accounts, just as you would with two-step verification. Without a backup way in, a lost device could mean a long account-recovery process.
Common questions
| Question | Short answer |
|---|---|
| Does the website see my fingerprint? | No. Your fingerprint or face is used only on your device to unlock the passkey. It is not sent to the website. |
| Do I have to give up passwords everywhere? | No. Many sites still need a password. Use a passkey where it is offered, and keep using strong, unique passwords elsewhere. |
| Is it safe to use on a shared computer? | Be careful. Sign in only on devices you trust, and sign out when you finish. |
Passkeys are not only more convenient than passwords. The design removes the two biggest weaknesses of passwords: reuse and phishing.