Passkeys explained: how to stop typing passwords

A passkey lets you sign in to a website or app with your fingerprint, face or phone PIN instead of a password. Google, Apple and Microsoft all support them, as do a growing number of banks, shops and services. They’re easier than passwords and much harder to steal.

How a passkey works

When you create a passkey, your device makes a matching pair of keys. The website keeps the public half; your device keeps the private half and never shares it. When you sign in, the site sends a challenge that only your private key can answer, and your device asks you to confirm with your fingerprint, face or screen lock before answering it.

Your fingerprint or face never leaves your device. It only unlocks the key.

Why they’re safer than passwords

• They can’t be phished. A passkey only works on the real website it was made for, so a fake login page can’t trick you into handing it over.
• There’s nothing to leak. If a website is hacked, the attackers only get public keys, which are useless on their own.
• No reuse. Every passkey is unique, so one breach can’t unlock your other accounts.
• Nothing to remember. No more resets because you forgot which variation you used.

Setting up your first passkeys

Start with your most important accounts, because your email account can reset most of your other passwords.

• Google account: open your account’s Security settings and look for Passkeys.
• Apple Account: on an iPhone or Mac with iCloud Keychain switched on, passkeys are saved automatically when a site offers them.
• Microsoft account: go to your account’s security settings and add a way to sign in, choosing a passkey or face, fingerprint or PIN.
• Other sites: look for “Passkeys” or “Sign-in methods” under account or security settings. If a site offers to create one when you log in, accept it.

What if I lose my phone?

Passkeys saved in Google Password Manager, iCloud Keychain or a password manager such as 1Password or Bitwarden are synced across your devices and backed up, so a new phone gets them back when you sign in to that account. Before relying on passkeys alone, make sure your account recovery options (a recovery phone number, email or codes) are up to date.

Should I delete my passwords?

Not yet. Most sites still keep your password as a back-up way in. Keep it long and unique, stored in a password manager, and switch on two-step verification. Over time, as more sites let you remove passwords completely, you can.