In this articleShow
Short answer: A passkey replaces your password with a cryptographic key stored on your phone, computer or password manager, unlocked with your fingerprint, face or device PIN. Passkeys can't be phished, reused or leaked in a data breach, and they're faster than typing a password. In 2026 they're mainstream: the FIDO Alliance reports around 5 billion passkeys in use and that 75% of consumers it surveyed have enabled one on at least one account. Turn them on for your important accounts now, and keep a password manager for everything else.
How passkeys work, in plain English
When you create a passkey for a website, your device generates two linked keys:
- A private key that stays on your device (or in your password manager) and never leaves it.
- A public key that the website stores.
When you sign in, the website sends a challenge; your device signs it with the private key after you unlock it with your fingerprint, face or PIN, and the website checks the signature with the public key. No secret is ever sent to the site — so there's nothing for hackers to steal from the site's database, and nothing for you to type into a fake site.
Passkeys vs. passwords
| Passwords | Passkeys |
|---|---|---|
Can be phished | Yes — you can type it into a fake site | No — the passkey only works on the real site's domain |
Leaked in breaches | Yes | No — the site only stores a public key |
Reused across sites | Often | Impossible — each passkey is unique |
Needs a separate 2FA code | Usually | No — the device and biometric act as two factors |
Speed | Type, then 2FA | One fingerprint or face scan |
Works everywhere | Yes | On a fast-growing but still incomplete list of sites |
Where to store your passkeys
Option | Syncs across | Best for |
|---|---|---|
Apple Passwords / iCloud Keychain | Apple devices | iPhone and Mac users |
Google Password Manager | Android, Chrome on any OS | Android and Chrome users |
Windows Hello | Windows devices (syncing is expanding) | Windows-only users |
Every platform | Mixed Apple/Windows/Android households | |
Hardware security keys (YubiKey etc.) | Not synced — the key itself | Highest-security accounts |
If you use devices from more than one company, a cross-platform password manager is the simplest place to keep passkeys.
How to set up your first passkeys
Start with the accounts that matter most:
- Your email account (Google, Microsoft, Apple ID) — it can reset everything else.
- Your password manager, if it supports passkey login.
- Banking and payment apps that offer passkeys.
- Shopping accounts with saved cards (Amazon, PayPal and others support them).
On each site, look under Security or Sign-in options for "Passkeys" or "Create a passkey," then follow the prompt.
What if I lose my phone?
- Synced passkeys (Apple, Google, password managers) are restored when you sign in on a new device.
- Keep a recovery method on each account — a second passkey on another device, a hardware key, or recovery codes stored safely.
- Device-bound passkeys on a single hardware key don't sync; register two keys and keep one somewhere safe.
Limitations to know about
- Not every site supports passkeys yet, so you'll still need a password manager for the rest.
- Many sites keep your old password as a fallback; where possible, also enable strong two-factor authentication.
- Moving passkeys between ecosystems is improving but still less smooth than moving passwords.
For businesses
CISA and other security agencies recommend phishing-resistant MFA — FIDO2/WebAuthn passkeys and security keys — over SMS codes and push approvals, which attackers can intercept or trick users into approving. The FIDO Alliance's 2026 research found 68% of organizations surveyed are deploying passkeys for employee sign-in. Start with administrators, finance and executives, who are the most targeted.
Frequently asked questions
Are passkeys safer than passwords?
Yes. They can't be phished, guessed, reused or stolen from a website's database.
Do passkeys replace two-factor authentication?
Effectively, yes. A passkey combines something you have (the device) with something you are or know (biometric or PIN).
Can a website see my fingerprint?
No. Your fingerprint or face is checked locally on your device; the website only receives a cryptographic signature.
Should I delete my passwords once I have passkeys?
Where a site lets you remove the password and rely on passkeys plus a recovery method, that's the most secure setup. Otherwise, keep a strong unique password in a password manager.
Sources
- FIDO Alliance, Passkey Index 2026 and World Passkey Day 2026 adoption report
- CISA, Implementing phishing-resistant MFA
- FIDO Alliance, Passkeys overview
