What is a passkey, and are passkeys safe? A plain guide

A passkey is a sign-in credential that replaces your password. Your device creates a pair of cryptographic keys for one website, keeps the private key, and proves it holds that key when you unlock the device with your fingerprint, face or PIN. There is nothing to type, so there is nothing to phish.

The industry group behind the standard, the FIDO Alliance, defines a passkey as "an authentication credential based on FIDO standards, that can be stored on your phone or computer, or in a hardware security key." Apple, Google and Microsoft all build on that same standard, which is why a passkey works much the same way everywhere.

How does a passkey work?

When you create a passkey for a site, your device generates two linked keys.

The public key goes to the website. It is not secret. A copy stolen from the site is useless for signing in.
The private key stays with you, on the device or in your password manager. Apple's documentation puts it this way: "The server never learns what the private key is."

When you sign in, the site sends a random challenge. Your device asks you to unlock it, signs the challenge with the private key, and sends back the signature. The site checks it against the public key. That is the entire exchange.

Two details make this stronger than it sounds. First, each passkey is tied to the real address of the site it was made for. A lookalike page at a different address simply gets no answer, because your device has no passkey for it. Second, every sign-in uses a fresh challenge, so a recorded response cannot be replayed.

Your fingerprint or face never leaves the device. The FIDO Alliance states that biometric information "is never sent to any remote server," and that the server only learns the check succeeded. Google says the same about its own accounts.

Passkey vs password: what changes?

	Password	Passkey
What the site stores	A scrambled copy of your secret	A public key, useless on its own
Can it be phished?	Yes, by any convincing fake page	No. It only answers the real site
Can it be weak or reused?	Often	No. Each one is unique and generated by the device
What a breach of the site exposes	Password hashes attackers can crack	Nothing that signs in
What you have to remember	The password	Nothing. You unlock your device
Second factor	Added separately	Built in: the device, plus your fingerprint, face or PIN

Are passkeys safe?

Yes. A passkey is the strongest sign-in method most people can use today, and it takes away three common ways accounts are lost: phishing, reused passwords, and passwords stolen in a breach. Apple describes passkeys as "resistant to phishing, are always strong, and are designed so that there are no shared secrets."

Safe is not the same as invulnerable, and the limits are worth knowing because they are where the attention should go.

The old doors stay open. Adding a passkey usually does not remove anything. Google's help page says so directly: adding a passkey "doesn't change or remove any authentication or recovery factors currently on your account." If the account still accepts a weak password, or a text-message code, an attacker will use that door and ignore the passkey.

Whoever unlocks your device holds your passkeys. Google warns that once you create a passkey, "anyone who can unlock your device can access your Google Account," and tells you never to create one on a shared device. Your screen lock is now part of your account security.

A synced passkey is as safe as the account that syncs it. If your passkeys live in iCloud Keychain or Google Password Manager, protecting that Apple or Google account matters more than ever.

It protects the sign-in, not the session. Malware on your computer that steals an already logged-in browser session does not need your passkey.

A five-minute check that closes the gap

On each important account, open the security settings and list every way to sign in and every recovery option.
Keep the passkey. Turn off text-message codes if a stronger option exists.
Replace the password that remains on the account with a long random one. A six-word passphrase is a good choice for the few you still need to type.
Set a strong screen lock on every device that holds passkeys.
Turn on two-factor authentication for the Apple, Google or Microsoft account that syncs them.

Where is my passkey stored?

This is the choice that decides what happens when a device is lost.

Type	Where it lives	Lost the device?	Best for
Synced passkey	A password manager that syncs: iCloud Keychain, Google Password Manager, Microsoft Password Manager, or a third-party manager	Sign in to the manager on a new device and your passkeys come back	Almost everyone
Device-bound passkey	One device only, such as a hardware security key or a computer using Windows Hello	It is gone with the device. Use another passkey or recovery method	Highest-security accounts

The FIDO Alliance says passkey syncing "is end-to-end encrypted," and that device-bound passkeys in hardware security keys "offer the highest security assurance." Apple states that iCloud Keychain is end-to-end encrypted with keys Apple does not know, and that any Apple Account using it must have two-factor authentication.

Government guidance has accepted synced passkeys too. NIST's digital identity standard, SP 800-63B revision 4, published in July 2025, added a section on "syncable authenticators." It notes that such a key "can only be used with a specific website," which "prevents a falsified web page from being able to capture and reuse" it.

What happens if I lose my phone?

With synced passkeys, very little. Set up the new phone with the same Apple or Google account, or sign in to your password manager, and the passkeys are there. Apple says passkeys are recoverable "even in the event that all associated devices are lost."

With a device-bound passkey, that one is lost. You sign in another way, with a second passkey, a backup security key or the account's recovery process, and create a new one. This is why Microsoft's advice for device-only passkeys is to create passkeys on your other devices as well, "to act as a digital spare key."

In both cases, remove the lost device's passkey from the account. For Google, go to myaccount.google.com/signinoptions/passkeys and remove it there. The thief still needs to unlock the phone to use it, but there is no reason to leave it listed.

How do I set up a passkey?

These steps come from each company's current help pages.

Google account

Go to myaccount.google.com/signinoptions/passkeys.
Select Create a passkey.
Unlock your device when asked.

Google notes that a new passkey may take up to 7 days before it is offered at sign-in.

Microsoft account

Sign in to Advanced Security Options at account.live.com/proofs/manage, as described on Microsoft's passkey page.
Choose Add a new way to sign in or verify.
Select Face, Fingerprint, PIN, or Security Key and follow the prompts.
Choose where to save it: a password manager, your phone, a security key, or the Windows device itself.

iPhone, for any site that supports passkeys

Sign in to the site or app and look for the option to create a passkey, usually in its security settings.
When iPhone offers to save a passkey, tap Continue.

The passkey is stored in the Passwords app. Apple requires iCloud Keychain and two-factor authentication to be turned on. If you see no passkey option, the site does not support passkeys yet.

Can I use a passkey on someone else's computer?

Yes, without leaving anything behind. Choose the option to use a passkey from another device, and the computer shows a QR code. Scan it with your phone, approve with your fingerprint or face, and you are signed in. The two devices use Bluetooth to confirm they are physically near each other, which stops someone far away from tricking you into approving their login. The FIDO Alliance notes that the sign-in itself does not rely on Bluetooth security.

Can I move my passkeys to another password manager?

This has been the weak spot, and it is being fixed. The FIDO Alliance has published Credential Exchange specifications that define a standard format for moving passwords, passkeys and other credentials between managers. Support depends on the manager you use. Where transfer is not available yet, the fallback always works: sign in to each account and create a new passkey in the new manager.

Are people really using them?

Yes. In a 2024 survey commissioned by the FIDO Alliance, 53% of people said they had enabled passkeys on at least one account. Microsoft reported in May 2025 that it was seeing nearly a million passkeys registered every day, that people signing in with passkeys succeeded about 98% of the time against 32% for passwords, and that new Microsoft accounts would be passwordless by default.

A passkey secures how you get in. What is kept behind the login is a separate question: for email, that depends on whether the provider can read the stored mail, which is what zero-access encryption addresses.

Frequently asked questions

Is a passkey the same as two-factor authentication?

It does the job of both steps at once. The FIDO Alliance describes a passkey as using multiple factors: the device you have, and the fingerprint, face or PIN that unlocks it. Google skips its second step when you sign in with a passkey for that reason. For how passkeys compare with text codes and authenticator apps, see our ranking of two-factor authentication methods.

Do I still need a password if I have a passkey?

On most accounts the password stays as a backup, so keep it long and unique. Some services let you remove it. Microsoft, for example, lets existing users delete their password in account settings.

Does a website get my fingerprint?

No. The fingerprint or face check happens on your device and only unlocks the private key. The site receives a signature, never your biometric data.

Can a passkey be hacked?

The cryptography is not the realistic target. The practical risks are a weaker sign-in method left on the same account, an unlocked or poorly locked device, and a compromise of the account that syncs your passkeys. Closing those three covers almost everything.

So, should you accept the prompt?

Yes. Create the passkey, save it somewhere that syncs, and then spend five minutes tightening the other ways into the account. If your inbox is the account you want to protect most, Secria Mail keeps every message in your mailbox under zero-access encryption.