Passkeys, Explained: The Login That Replaces Your Password
More sites now offer passkeys instead of passwords. They are easier and much harder to phish. Here is how they work and how to start.
Wren Takahashi Security and Web Editor
A passkey lets you sign in with the same fingerprint, face scan or PIN you use to unlock your phone or laptop. There is no password to type, remember or leak, and that changes the security picture more than it might first appear.
How a passkey works
When you create a passkey, your device makes a matched pair of digital keys. The website keeps one, which is useless on its own. Your device keeps the other, locked behind your fingerprint or PIN. To sign in, the site sends a challenge that only your private key can answer.
Why it beats a password
A fake login page can trick you into typing a password. It cannot trick a passkey, because the passkey only responds to the real website it was created for. And because the site never holds a secret that works on its own, a data breach at the site does not expose a reusable password.
A fake login page can steal a password. It cannot steal a passkey.
Setting one up
-
Find the option
In the account's security settings, look for Passkeys or Sign in without a password.
-
Create it
Confirm with your fingerprint, face or device PIN. The passkey is saved to your device or password manager.
-
Keep a fallback
Leave a second sign-in method in place, such as another passkey on a second device or a recovery code stored safely.
What if I lose my phone?
Passkeys saved in your phone's or computer's password manager sync to your other signed-in devices, so losing one device does not lock you out. That is also why it is worth protecting the account that holds them with strong security of its own.
Do passkeys replace a password manager?
Not quite. Passkeys are usually stored in a password manager, whether the one built into your phone or a separate app, and most people will have a mix of passkeys and passwords for years while sites catch up. The manager remains the one place that holds both.
If you use more than one ecosystem, say an Android phone and a Windows laptop, check that your manager can sync passkeys across them, or plan to create a separate passkey on each device. Most sites let you register several.
psst, there is a letter