What Is a Passkey? How Passkeys Replace Passwords (and How to Set One Up)
Passkeys explained simply: how they work, why they stop phishing, how they sync between devices, and step-by-step setup for Google, Apple, Microsoft and other accounts.
Some links in this guide are affiliate links: if you buy, TechForLive may earn a commission at no extra cost to you. Details.
How a passkey works
When you create a passkey, your device makes a matching pair of cryptographic keys:
- A public key that the website stores. It is useless to a thief on its own.
- A private key that never leaves your device or password manager.
When you sign in, the website sends a random challenge. Your device asks for your fingerprint, face or PIN, signs the challenge with the private key, and sends back the signature. The site checks it with the public key. No password crosses the internet.
Passkeys are tied to the real website's domain, so a fake look-alike site simply cannot trigger them. That is what makes them phishing-resistant. They are built on open standards (FIDO2/WebAuthn) developed by the FIDO Alliance with Apple, Google and Microsoft.
Where passkeys are stored
| Ecosystem | Where they live | Syncs to |
|---|---|---|
| Apple | iCloud Keychain / Passwords app | Your iPhone, iPad and Mac |
| Google Password Manager | Android and Chrome where you are signed in | |
| Microsoft | Windows Hello / Microsoft account | Windows devices (sync support is expanding) |
| Password managers | 1Password, Bitwarden, Dashlane and others | Every device the manager runs on |
| Hardware keys | A physical security key (USB/NFC) | Wherever you plug or tap it |
To sign in on someone else's computer, choose "use a phone or tablet", scan the QR code with your phone and approve with your fingerprint.
Set up your first passkeys
- Google: go to your Google Account › Security › Passkeys and security keys › Create a passkey.
- Apple Account: devices signed in to iCloud with two-factor authentication can use passkeys on supported sites; Apple prompts you when a site offers one.
- Microsoft account: account.microsoft.com › Security › Advanced security options › Add a new way to sign in.
- Other sites: look in Security or Login settings for "Passkey", or accept the prompt that appears after you sign in.
Start with your email account: whoever controls your email can reset almost everything else.
Keep a backup way in
- Have passkeys on at least two devices (they sync within an ecosystem).
- Keep recovery codes or a recovery email/phone up to date.
- Do not delete your password straight away on every site until you are comfortable.
Passkeys vs passwords vs 2FA codes
| Password | Password + SMS code | Passkey | |
|---|---|---|---|
| Can be phished | Yes | Yes (code can be relayed) | No |
| Leaks in breaches | Yes | Password yes | No (only public key stored) |
| Effort | Typing | Typing + waiting | One touch |
Still using passwords somewhere? Check how strong they are privately:
Free toolPassword Strength CheckerPrivate check: entropy and weak patterns.Open →Quick answers
What happens if I lose my phone?
If your passkeys sync (iCloud, Google, a password manager), they are restored when you sign in on a new device. Keep a second device or recovery method set up.
Can a website see my fingerprint?
No. Your fingerprint or face only unlocks the key on your device; it is never sent to the website.