Passkeys Explained: The Password Replacement You Should Start Using
Passwords can be guessed, reused, leaked and phished. Passkeys are a newer way to sign in that avoids these problems. Instead of typing a password, you confirm with your phone's fingerprint, face or screen lock.
How passkeys work
When you create a passkey, your device makes a pair of digital keys. One stays secretly on your device; the other is stored by the website. When you sign in, your device proves it has the secret key, after you unlock it with your fingerprint, face or PIN. Nothing secret is sent to the website.
Why they're safer
- Can't be phished: passkeys only work on the real website they were created for.
- Nothing to leak: websites don't store your secret key, so breaches don't expose it.
- No reuse: each passkey is unique.
- Faster: sign in with a fingerprint instead of typing.
Where passkeys are stored
- Android: Google Password Manager, synced across your Android devices and Chrome.
- iPhone and Mac: Apple Passwords / iCloud Keychain.
- Windows: Windows Hello.
- Password managers like 1Password, Bitwarden and others.
Set up a passkey for Google
- Go to myaccount.google.com → Security → Passkeys and security keys.
- Click Create a passkey and confirm with your device's screen lock.
Other services
Many services support passkeys, including Microsoft, Apple, Amazon, PayPal, WhatsApp and others. Look in security settings for "Passkeys", or accept the prompt when a site offers to create one.
Signing in on another computer
On a computer without your passkey, choose "Use a phone or tablet". A QR code appears; scan it with your phone and confirm with your fingerprint.
What if I lose my phone?
Passkeys sync to your Google or Apple account, so they're restored when you sign in on a new device. Keep account recovery options up to date and keep passwords or backup codes available as a fallback.
Passwords vs 2FA vs passkeys
| Method | Phishing risk | Leak risk | Convenience |
|---|---|---|---|
| Password only | High | High | Medium |
| Password + SMS code | Medium | Medium | Lower |
| Password + authenticator app | Medium | Low | Lower |
| Passkey | Very low | Very low | High |
Passkeys are one of the rare security upgrades that are both safer and easier to use.
Common concerns
"What if someone steals my phone?"
They still need to unlock your phone with your fingerprint, face or PIN to use the passkey. Protect your screen lock and turn on theft protection features.
"Can I use passkeys on a shared family computer?"
It's better to sign in using your phone via QR code on shared computers, rather than saving passkeys to a device others use.
"Do I need to understand the technology?"
No. When a site offers "Create a passkey", accept it and confirm with your fingerprint. Next time, choose "Sign in with passkey".
A simple plan to start
- Add a passkey to your Google or Apple account.
- Add one to your Microsoft account if you use Windows or Outlook.
- Accept passkeys when shopping, social and payment sites offer them.
- Keep your password manager for sites that don't support passkeys yet.
Frequently asked questions
Does the website get my fingerprint?
No. Your fingerprint never leaves your device; it just unlocks the passkey.
Can I still use my password?
Usually yes. Passkeys are added alongside passwords on most sites.
Keep reading
What Is a VPN and Do You Actually Need One?
A plain-English explanation of VPNs: what they protect, what they don't, when they're useful, and how to choose a trustworthy one.
SIM Swap Scams: How Criminals Steal Your Phone Number
Learn how SIM swap fraud works, the warning signs, and how to protect your bank and accounts that rely on SMS codes.
10 Signs Your Account Has Been Hacked (and What to Do)
Recognise the warning signs that your email, social media or other accounts are compromised, and take back control quickly.