- What is a passkey
- How they work
- Why they are safer
- Vs passwords
- Synced vs device-bound
- Support
- Limits
- What to do
- FAQ
What Is a Passkey?
The FIDO Alliance, the industry group behind the standards, defines a passkey as an authentication credential that can be stored on your phone or computer, or in a hardware security key, and that lets you sign in to apps and websites using the same process you use to unlock your device. In practice that means a fingerprint, face scan, PIN or pattern, instead of a typed password.
How Passkeys Work
Passkeys use public-key cryptography. Each passkey is a pair of mathematically linked keys: a public key that the website stores, and a private key that stays on your device.
- You create a passkey. Your device generates a key pair for that website. The public key is sent to the site. The private key never leaves your device or your passkey provider.
- You sign in. The website sends a one-time challenge to your device.
- You approve with your usual unlock. You use your fingerprint, face, PIN or pattern to authorise the use of the private key.
- Your device signs the challenge. The website checks the signature with the stored public key and lets you in. No secret is ever typed or sent.
Why Passkeys Are Harder to Steal
- Nothing secret is stored on the website. If a site is breached, attackers get public keys, which cannot be used to sign in.
- They resist phishing. A passkey is tied to the real website it was created for, so a fake lookalike site cannot ask your device to sign in on its behalf. The FIDO Alliance describes passkeys as phishing-resistant for this reason.
- They cannot be reused or guessed. Each site gets its own key pair, so there is no weak or repeated password to attack.
- They are quick. There is no password to remember, type or generate.
Passkeys vs Passwords
| Question | Password | Passkey |
|---|---|---|
| What do you provide? | A secret you know | Your device unlock (biometric, PIN or pattern) |
| What does the site store? | A hash of your password | Only a public key |
| Can it be phished? | Yes, if you type it into a fake site | Resistant, because it is bound to the real site |
| Can it be reused or guessed? | Yes | No |
| What if the site is breached? | Hashes can be attacked offline | Stolen public keys cannot sign in |
| Where is it supported? | Almost everywhere | Many major services, but not all |
Synced and Device-Bound Passkeys
The FIDO Alliance describes two models. Synced passkeys are available across your devices through a cloud sync service, which FIDO says is end-to-end encrypted. Device-bound passkeys never leave a single device, including passkeys on hardware security keys. Synced passkeys are more convenient and easier to recover. Device-bound passkeys give you tighter control but make loss of the device more serious.
Who Supports Passkeys?
According to the FIDO Alliance, passkeys are supported in all major operating systems and browsers and by third-party passkey providers. It names Apple, Google and Microsoft among the adopters, and password managers such as 1Password and Dashlane. Support still varies from website to website, so check the security settings of each important account. The FIDO Alliance also reports a survey finding that 53% of people had enabled passkeys on at least one account, and 22% on every account they could.
Limits and Risks to Know About
- Recovery is the weak point. If you lose every device and have no recovery option, regaining access can be hard. Set up recovery methods before you need them.
- Your device unlock now matters more. Anyone who can unlock your phone or computer may be able to use the passkeys on it. Use a strong device PIN and keep it private.
- Provider choice matters. Synced passkeys depend on the account or password manager that stores them. Choose a provider you trust and protect that account well.
- Most sites still use passwords. For now, you will need both.
What to Do Today
- Turn on passkeys for your most important accounts where the service offers them, starting with your email.
- Keep a strong random password everywhere else, generated with the Strong Password Generator and stored in a password manager. If you use Google, our Gmail Password Generator is built for that.
- Keep two-factor authentication on accounts that still rely on a password.
- Set up account recovery and write down any recovery codes somewhere safe.
- Avoid the weakest passwords on any account that has not moved to passkeys yet. See the most common passwords.
Sources
- FIDO Alliance: Passkeys, the FIDO Alliance's description of passkeys, how they work, the synced and device-bound models, and platform support. Read on 7 October 2026.