Passkeys explained: what they are, where they live, and whether to switch

A passkey is a way to sign in without typing a password. When you create one, your device makes a pair of linked keys. The public key goes to the website and is not secret. The private key stays with you, inside your phone, computer or password manager, and the site never sees it. To sign in, the site sends a challenge, your device signs it with the private key after you unlock it, and the site checks the signature against the public key.

The standard behind this is FIDO2 / WebAuthn, written by the FIDO Alliance and the W3C and supported by Apple, Google and Microsoft. The developer site passkeys.dev is run by the same group if you want the technical detail.

Your fingerprint or face never leaves the device. It only releases the key locally, the same way it unlocks your phone. Google and Microsoft both say so plainly in their passkey help pages.

A password with two-factor authentication is good protection. A passkey is better in two specific ways.

The phishing point matters most. Modern phishing kits pass whatever you type, code included, straight to the real site. A passkey is bound to the website it was made for, so a lookalike domain cannot trigger it. That is why our phishing guide calls passkeys the one defence that does not depend on you noticing the fake.

A passkey is saved by a credential manager, and which one you pick decides which devices can use it.

• Apple (iCloud Keychain / the Passwords app): syncs across iPhone, iPad and Mac signed in to the same Apple Account. Apple says iCloud Keychain is end-to-end encrypted and requires two-factor authentication on the account. See Apple's passkey security overview.
• Google Password Manager: syncs across Android phones and Chrome where you are signed in to Google. Google's requirements are Android 9 or later, iOS 16 or later, and on computers Windows 10, macOS Ventura or ChromeOS 109 or later. See Google's passkey help.
• Windows Hello and Microsoft Password Manager: Windows can keep a passkey on the PC (device-bound, unlocked with Windows Hello) or in a synced manager. Microsoft recommends a synced manager so you are not tied to one computer. See Microsoft's passkey page.
• Third-party password managers: Proton Pass, 1Password, Bitwarden and others store passkeys and sync them across Apple, Android and Windows at once. If you use an iPhone and a Windows laptop, this is usually the simplest setup.

You can use a passkey on your phone to sign in on someone else's computer, or on a computer from a different ecosystem. Choose the option to use a passkey from another device. The computer shows a QR code; scan it with your phone, confirm with your face, fingerprint or PIN, and you are in. The two devices check they are near each other over Bluetooth, so a remote attacker cannot relay the QR code. The passkey itself is never copied to the computer.

On a shared or public computer, use this method rather than creating a new passkey there. Google warns against creating a passkey on a shared device, because anyone who can unlock that device could then sign in as you.

If your passkeys are synced, nothing is lost. Sign in to your Apple, Google or password manager account on a new device and they come back. Apple describes recovery through iCloud Keychain even when all your devices are gone, using your Apple Account password, a code sent to your phone number and a previous device passcode, or a recovery contact you set up in advance.

Three things to do now, before anything goes missing:

1. Make sure your Apple, Google or password manager account has current recovery options: a phone number you still have, a recovery email, or a recovery contact or key.
2. Keep at least one other way into your most important accounts, such as backup codes stored safely, or a second device signed in.
3. If a device is lost or stolen, remove its passkeys from your accounts (Google lists this under "Remove a passkey on a lost or stolen device") and lock or erase the device remotely.

Device-bound passkeys, such as one saved only in Windows Hello on a single PC or on a hardware security key, do not sync. If that device dies, that passkey is gone and you fall back to the site's account recovery.

On most sites, you cannot, and that is fine. Adding a passkey usually leaves your password and existing two-factor settings in place; Google says so explicitly. The password becomes a backup way in, which also means it is still a way in for an attacker who has it.

So treat the password as a spare key:

• Make it long, random and used nowhere else, and keep it in a password manager.
• Check whether it has already leaked with our guide to checking for leaked passwords, and change it if so.
• Where a site lets you go fully passwordless (Microsoft accounts offer this), consider it for accounts you always open on your own devices.

Start with the accounts that unlock everything else: your email, your Apple or Google account, your bank and your mobile carrier. If your carrier account is weak, read how to protect yourself from SIM swaps too, because a stolen phone number can undo SMS-based recovery.