Passkeys replace passwords with cryptographic keys tied to your device and biometrics. They’re resistant to phishing and data leaks—and they’re easier to use.

What is a passkey?

A passkey is a pair of keys: a public key stored with the service and a private key that stays on your device (or security key). You unlock it with your fingerprint, face, or device PIN—no password to type, no code to phish.

Why it’s safer

  • Phishing-resistant (keys won’t sign on fake sites).
  • No credential reuse leaks.
  • Stored in hardware-backed vaults or secure elements.

How it works

Sites use WebAuthn/FIDO2. Your browser verifies the domain, then asks your device to sign a challenge with the private key.

Set up on your devices

Phone (iOS/Android)

  • Update OS and browser.
  • Turn on device screen lock + biometrics.
  • Enable cloud backup/sync for passkeys if offered (helps recovery).

Laptop/Desktop

  • Chrome, Safari, Edge, Firefox (latest).
  • Allow the browser to use your platform authenticator (Touch ID/Windows Hello).

Hardware key (optional)

  • Register a FIDO2 key as a roaming passkey.
  • Great for admins and travelers; store a spare separately.

Turn on passkeys in apps

Most major services now support passkeys. The flow usually looks like this:

  1. Log in normally and go to Security or Sign-in options.
  2. Select Add passkey (or Set up passkey).
  3. Choose the device you’ll use (this device, phone nearby, or hardware key).
  4. Approve with Touch ID/Face unlock/PIN. You’re done.

If a site still uses passwords, keep your password manager + 2FA turned on. Many sites let you store a passkey alongside an existing password during the transition.

Recovery, backups & travel

Backups

Allow encrypted cloud sync on your phone/laptop for “platform” passkeys. Add at least one hardware key as a safety net.

Recovery codes

Some services still offer backup codes—store them offline. They’re last-resort access if you lose every device.

Travel

Register two devices (e.g., phone + laptop) or carry a hardware key. Disable SMS fallback where possible.

Switching phones: smooth hand-off

  1. On the old phone, confirm passkey sync is on and recent.
  2. Set up the new phone; sign into the same cloud account; enable biometrics.
  3. Test a few logins. Keep the old phone or a hardware key as backup for a week.

FAQs

Can a hacker steal my passkey from a data breach?

Breaches expose public keys, which are useless without your private key. The private key never leaves your device or hardware key.

What if I wipe my phone?

Restore from your platform’s encrypted passkey backup, or use your hardware key/recovery codes to sign in and re-enroll.

Do I still need a password manager?

Yes—for the sites that haven’t moved to passkeys yet, and to store backup codes/secure notes.