Passkeys are the most significant change to logging in for decades. You may already have been asked to create one. This explainer is part of our two-factor login and passkeys guide.
What a passkey is
A passkey is a pair of mathematically linked keys. One is private and stays on your device or in your password manager. The other is public and stored by the website.
When you log in, the site sends a challenge. Your device signs it with the private key, after you unlock it with a fingerprint, face or PIN. The site checks the signature with the public key. No secret travels over the internet at all.
Why passkeys are safer than passwords
- Nothing to phish. A passkey only works on the real site it was made for, so fake login pages get nothing.
- Nothing to leak. The website holds only a public key, so a data breach exposes nothing useful for logging in.
- Nothing to reuse. Every site gets its own unique passkey.
- Nothing to remember. You just unlock your device.
How to create one
- Go to the account's security settings.
- Choose "create a passkey".
- Confirm with your fingerprint, face or PIN.
Your device saves it. Next time, choose "sign in with a passkey".
Where passkeys are stored
| Location | Good for | Note |
|---|---|---|
| Apple or Google account | Most people | Syncs across your devices |
| Password manager | People who use many brands | Syncs across platforms |
| Hardware security key | Highest security | Does not sync, so register a backup |
The downsides
- Not every site supports them yet.
- Moving between ecosystems is still improving.
- Your Apple, Google or manager account becomes very important, so protect it well.
- Many sites still keep a password as a fallback, which can remain a weak point.
Will passkeys replace passwords?
Gradually. Many major services now offer them, and government guidance favors phishing-resistant login. But old systems change slowly, so you will still need passwords and a password manager for years.
For the practical choice between them, see passkeys vs passwords vs 2FA.