A passkey is a login credential that replaces your password with a pair of cryptographic keys: the website stores a public key, and the matching private key stays on your device or in your password manager, unlocked by your fingerprint, face or device PIN. Signing in means your device proves it holds the private key by signing a one-time challenge, so there is no password to type, reuse, leak or phish.
Passkeys are built on the FIDO2 standards, and on the web they use the W3C's Web Authentication API (WebAuthn). The passkeys.dev glossary defines a passkey as "the high level, end-user centric term for a FIDO2/WebAuthn Discoverable Credential." Apple, Google and Microsoft all support them in their operating systems and browsers, as do the major password managers.
How passkeys work, step by step
Creating a passkey
- You choose "Create a passkey" on a site. The site's server sends your browser a random challenge plus its own identifier, such as
example.com. - Your browser asks your device to create a credential. You approve with a fingerprint, face scan or PIN.
- The device generates a brand-new key pair for that one site and account. MDN describes it: "After the authenticator obtains user consent, it generates a key pair and returns the public key".
- The server checks the challenge and the origin, and saves the public key against your account.
The private key never goes to the website. Apple's security page puts it plainly: "The server never learns what the private key is." The public key it does store "is not a secret."
Signing in with a passkey
- The site sends a fresh random challenge. MDN notes it must be at least 16 bytes of random data.
- Your device shows the passkeys it has for that site. You pick your account and unlock with fingerprint, face or PIN.
- The device signs the challenge with the private key and returns the signature.
- The server verifies the signature with the public key it stored, confirms the challenge matches and checks that the request came from its own domain. You're in.
Because every challenge is new, a captured signature is useless a second time.
Why passkeys beat passwords
| Problem | Password | Passkey |
|---|---|---|
| Phishing site asks for it | You can type it in, and it works for the attacker | Browser won't offer it; a signature for the wrong origin is rejected |
| Site's database is breached | Password hashes can be cracked offline | Attackers get public keys, which are not secret |
| Reuse across sites | Common, and one leak opens many accounts | Impossible; every site gets its own key pair |
| Weak choice | Up to you | Keys are generated by the device |
| Typing on shared or watched screens | Can be observed or keylogged | Nothing secret is typed into the site |
The phishing protection deserves a closer look, because it doesn't depend on you spotting the fake. WebAuthn credentials are "scoped" to the site that created them: the spec says a credential "can only be accessed by origins belonging to that Relying Party". MDN's summary: "An attacker who creates a fake login website can't login as the user because the signature changes with the origin of the website." The FIDO Alliance describes passkeys as "always strong and phishing-resistant."
Where passkeys are stored: synced vs device-bound
The FIDO Alliance says passkeys "can be securely synced across a user's devices, or bound to a particular device."
- Synced passkeys live in a passkey provider and follow your account to new devices. Apple syncs them through iCloud Keychain, which it says "is end-to-end encrypted with strong cryptographic keys not known to Apple". Google Password Manager syncs them between Android devices and Chrome signed in to the same Google account, and Android 14 and later can use a third-party password manager instead.
- Device-bound passkeys stay on one authenticator, typically a hardware security key, and can't be copied off it. They suit high-security accounts and workplaces that need to know exactly where a credential lives.
Most people use synced passkeys, because losing a phone then doesn't lock you out.
Using a passkey from your phone on another computer
If your passkey is on your phone but you're signing in on a laptop that doesn't have it, choose the option to use another device. The laptop shows a QR code; you scan it with your phone, approve on the phone, and the laptop is signed in. The FIDO name for this is cross-device authentication over the "hybrid" transport. It checks that the phone is physically nearby, which is why Microsoft's instructions note that Bluetooth may be required, and Google's documentation says the phone must be close to the computer. A remote attacker can't complete the flow by sending you a QR code from far away.
Does the website see your fingerprint?
No. The biometric check happens entirely on your device and only unlocks the private key. FIDO: "Biometric information and processing continues to stay on the device." Google states that "biometric material never leaves the user's personal device." If you'd rather not use biometrics, the device PIN or password works the same way.
How to start using passkeys
- Pick a passkey provider: your phone's built-in one (iCloud Keychain, Google Password Manager), Windows Hello, or a password manager that supports passkeys. If you use several platforms, a cross-platform password manager keeps everything in one place.
- Go to the security settings of an important account (email first, since it can reset everything else) and look for "Passkeys" or "Sign in with a passkey".
- Create the passkey and approve with your fingerprint, face or PIN.
- Sign out and back in once to confirm it works.
- Keep a second sign-in method: another passkey on a different device or security key, or the site's recovery codes.
Limitations to know about
- Fallbacks weaken the gain. If an account still accepts a password or an SMS code, an attacker can target those. Where a site allows it, remove the password once passkeys work on all your devices.
- Not every site supports them yet. Keep a password manager for the rest; how password managers work explains what protects those passwords. For the cryptography behind key pairs, see public key cryptography explained.
Frequently asked questions
- Does the website get my fingerprint or face scan?
- No. The fingerprint, face or PIN only unlocks the passkey on your own device. The FIDO Alliance states that biometric information and processing stay on the device, and Google's passkey documentation says biometric material never leaves the user's device. The website receives a signature, not your biometric data.
- What happens to my passkeys if I lose my phone?
- Synced passkeys are also stored in your passkey provider's cloud account, such as iCloud Keychain, Google Password Manager or a third-party password manager, so they come back when you sign in on a new device. A device-bound passkey, such as one on a hardware security key, is gone with the device, which is why sites let you register more than one passkey or keep another recovery method.
- Can a passkey be phished?
- Not in the way passwords are. A passkey is tied to the website that created it, and the browser only offers it on that site's real domain. A look-alike site gets nothing it can reuse, because the signature depends on the site's origin and on a one-time challenge. Attackers can still try to trick you into weaker fallback methods, such as a password or SMS code, if the account keeps them.
- Are passkeys the same as two-factor authentication?
- A passkey sign-in already combines two factors: something you have (the device holding the private key) and something you are or know (the fingerprint, face or PIN that unlocks it). That is why many sites skip the separate one-time code when you sign in with a passkey.