What a passkey actually is
A password is a shared secret: you know it, the website knows it, and anyone who obtains it can be you.
A passkey is a pair of cryptographic keys. When you create one, your device generates two mathematically linked keys. The public key goes to the website. The private key never leaves your device or your password manager — the website never sees it and never stores it.
To sign in, the site sends a challenge. Your device asks you to confirm with your fingerprint, face, or device PIN, signs the challenge with the private key, and sends back the signature. The site verifies it with the public key it already has. Nothing reusable is transmitted.
One important detail: your fingerprint or face is not sent anywhere. Biometrics only unlock the key locally on your own device. The website receives a signature, never anything about your body.
Why it beats a password
It cannot be phished
This is the big one. A passkey is bound to the exact domain it was created for. If you land on a convincing copy of your bank's site at a lookalike address, your device simply will not offer the passkey — not because you noticed the URL, but because the cryptography doesn't match. It removes human vigilance from the equation, which matters because modern phishing pages are indistinguishable from the real thing by eye.
There's nothing to steal in a breach
When a company is breached, what leaks is the public key — which is useless on its own. Compare that with password databases, which are stolen constantly and then tested against every other service you use.
Reuse stops being a risk
Each passkey is unique to one site by design. There's no equivalent of "I used the same password on forty sites and one of them got hacked."
No codes to intercept
SMS codes can be intercepted by SIM-swap attacks and are routinely phished in real time by fake login pages. A passkey has no code to type, so there's nothing for an attacker to relay.
The failure mode nobody warns you about
Here's what the sign-up prompt doesn't tell you. A passkey lives somewhere — and where it lives determines what happens when things go wrong.
If you tap "create a passkey" on an iPhone, it typically goes into your Apple account keychain. On an Android phone, into your Google account. On a Windows PC, potentially into that machine's hardware alone. This produces two problems:
- Ecosystem lock-in. A passkey created on your iPhone syncs to your other Apple devices. It does not automatically appear on a Windows work laptop. You can usually sign in by scanning a QR code with the phone that holds it — but that requires having that phone with you, charged, every time.
- Single point of failure. A passkey stored only in one device's hardware, with no sync, is gone if that device is lost, stolen, or destroyed. And if it was your only sign-in method, so is the account.
Then the deeper issue: account recovery is now the weakest link. If a service lets you fall back to "email me a reset link" and your email is protected by a password plus an SMS code, an attacker doesn't need to break your passkey at all. They go around it. Upgrading your sign-in while leaving recovery on SMS moves the lock to the front door and leaves the window open.
Never have exactly one way into an important account. Two independent methods is the target: a passkey that syncs, plus either a second passkey on a different device or saved recovery codes stored somewhere physical. One method is fragile. Three or more, and you're just enlarging the attack surface.
Setting them up properly
1. Decide where your passkeys will live
Choose deliberately rather than accepting whichever default appears:
- A cross-platform password manager (for example 1Password or Bitwarden) stores passkeys and makes them available on every device and operating system you use. This is the best option for most people, especially anyone who mixes Apple, Android, and Windows.
- Your platform's built-in keychain — Apple, Google, or Microsoft — is convenient and free, and syncs well within that ecosystem. Fine if you genuinely live on one platform.
- A hardware security key (a physical USB or NFC device) is the strongest option and cannot be extracted remotely at all. Best as a backup for high-value accounts rather than as your everyday method — and buy two, because a single hardware key is the definition of a single point of failure.
2. Register a second method immediately
The moment you create a passkey on an important account, add a backup before you close the tab. Most services let you register more than one passkey: add one from your phone and one from your laptop or hardware key.
3. Save the recovery codes — offline
Most services offer one-time recovery codes when you enable strong authentication. Download them and store them somewhere that survives losing your phone: printed in a drawer, in a safe, or written down at a trusted family member's house. Storing recovery codes only inside the account they recover is a circle you cannot escape.
4. Fix the recovery path
Go back through the account's security settings and check what it will accept if you say you've lost everything. If it will send a reset link by email, then your email account is the real lock on everything — secure that one first and best. Where possible, remove SMS as a recovery method in favour of an authenticator app or a second passkey.
Which accounts to do first
Don't try to convert everything in one sitting. Work down in this order — it's ordered by how much damage losing the account would do:
- Your primary email. Everything else resets through it. This is the account that matters most, and it's the one people secure last.
- Your password manager, if you use one.
- Your platform account — Apple, Google, or Microsoft — since it holds your devices, backups, and often your passkeys themselves.
- Financial accounts that support passkeys: banks, payment services, brokerages.
- Anything with your payment details stored: major retailers, marketplaces, food delivery.
- Social and messaging accounts, which are used to impersonate you to people who trust you.
- Everything else, whenever a site happens to offer it.
Doing the first three properly is most of the benefit. If you only ever do one thing from this article, make it your email account.
What to do about your remaining passwords
Passkey support is broad but far from universal, so passwords aren't going anywhere for years. For everything still using one:
- Use a password manager. This remains the highest-value security habit available. Unique passwords everywhere is impossible to do by memory and trivial with a manager.
- Long beats complicated. A passphrase of four or five unrelated words is both stronger and easier to type than a short string of symbols. Length is what defeats guessing.
- Prefer app-based codes over SMS. An authenticator app is not vulnerable to SIM swapping. Where a service supports it, it's a clear upgrade.
- Check what's been breached. Most password managers now flag reused and exposed credentials automatically. Fix anything flagged, starting with reuse.
Common questions
What if I lose my phone?
If your passkeys are in a synced keychain or password manager, you sign in on a new device with that account and they're all there. If a passkey existed only in the lost device's hardware, you need the account's backup method — the second passkey or recovery codes you set up earlier. This question is precisely why step 2 above is not optional.
Can I still use my password after adding a passkey?
Usually yes; the passkey is added alongside it at first. Some services later offer to remove the password entirely, which closes off password-based attacks completely. Only do that once you're confident in your backups — it's a one-way door on most services.
Are passkeys safe if my phone is stolen?
A thief needs both the device and your biometric or device PIN to use a passkey. That's meaningfully harder than reading a password out of a browser, or intercepting an SMS on a locked screen. Do make sure your phone actually has a strong lock and that message previews aren't visible while locked.
Is it a problem that a company holds my passkeys?
Passkeys in a synced keychain are encrypted, and reputable providers are designed so they cannot read them. It's a reasonable trade: a very small centralised risk in exchange for eliminating phishing, credential stuffing, and password reuse — which are what actually compromise accounts in practice.
The short version
Passkeys are better than passwords in the ways that matter, and worth adopting. Store them somewhere that syncs across every platform you use, register a second method the same day you create the first, save recovery codes offline, and fix the recovery path so it isn't weaker than the lock you just installed. Start with your email account.