Introduction
You open your Google account, Amazon or PlayStation, and instead of a password box the site offers to "sign in with a passkey". Your phone asks for your face or your PIN, and you are in. Nothing was typed. A few weeks later the same site suggests deleting your password altogether, and it is fair to wonder what exactly you would be trusting instead.
A passkey is a sign-in that replaces your password with a pair of cryptographic keys. One key stays on your device or in your password manager, the other sits with the website. To log in, your device proves it holds the matching key, after you unlock it with your face, fingerprint or screen lock. There is no secret to type, so there is nothing to reuse, guess or hand over to a fake page.
Below: passkeys explained step by step. What a passkey is and how it works, where passkeys are stored, how they work across devices, passkey vs password and 2FA, and are passkeys safe, including the attacks researchers published in 2025 and 2026. There is also a video version at the end.
What is a passkey?
A passkey is a login credential built on the FIDO standards and the W3C Web Authentication standard (WebAuthn). In plain terms, what are passkeys? They are a replacement for the password field, created by your device for one account on one website.
An example of a passkey in daily use: you create a Google passkey on your phone. From then on, signing in to Google on that phone means looking at the screen or touching the fingerprint sensor. On a laptop, Chrome can offer the same passkey from Google Password Manager, or show a QR code to scan with the phone. The website never learns a secret it could leak.
Three things make a passkey different from every password you have used:
- It is created by your device, not chosen by you, so it cannot be weak or repeated on another site.
- It is tied to one website address. A passkey for google.com is useless on a look-alike domain.
- The secret part never leaves your device during sign-in. The site only checks a signature made with it.
How do passkeys work?
Passkeys run on public-key cryptography, the same idea that protects HTTPS, applied to logging in.
When you create a passkey, your device generates a key pair just for that account. The private key is stored by the device or your password manager. The public key goes to the website, which stores it next to your account. A public key can check a signature, but it cannot create one, so a website that leaks its database leaks nothing that lets anyone sign in with your passkey.
When you sign in, the exchange looks like this:
- The site sends a random one-time value, called a challenge, so an old signature cannot be replayed later.
- Your device asks you to prove it is you: face, fingerprint, PIN or the device passcode. This check happens on the device.
- The device signs the challenge together with the address of the page that asked for it.
- The site checks the signature with the public key it stored. If it matches, you are in.
Does the website get your fingerprint or face?
No. The WebAuthn standard states that biometric data is not revealed to the website and is used only on the device to verify the user. The site receives a signature and a couple of flags that say a person was present and was verified. Apple adds that Face ID data never leaves the device and is never backed up to iCloud. If you would rather not use biometrics at all, a PIN or the device passcode does the same job.
Why passkeys are phishing resistant
Each passkey is bound to the site's domain, which the standard calls the relying party ID. The browser itself adds the real address of the page to the signed data, and the site must reject a signature made for any other address. So a passkey is phishing resistant by design: on a fake page at a look-alike address, the phone does not offer the passkey at all. There is no code to read out and no box to type it into.
Per-site keys and privacy
Every passkey is a separate key pair. A site cannot ask your device about passkeys you hold for other sites, and two sites cannot match you up by comparing keys. That is a real privacy gain over a reused password or a single login identity. Sites can still recognise you by your email address or phone number, and by other signals such as a browser fingerprint, but the passkey itself does not link your accounts.
Where are passkeys stored?
A passkey lives in one of two kinds of place, and the difference matters for recovery and for risk.
Synced passkeys live in a password manager that copies them to all your devices. The standard calls them multi-device credentials, and a device reports to the site whether a passkey is eligible for backup and whether it is backed up.
- Apple keeps passkeys in iCloud Keychain, shown in the Passwords app. They are end-to-end encrypted, so Apple cannot read them, and iCloud Keychain requires two-factor authentication on the Apple Account.
- Google keeps passkeys in Google Password Manager, end-to-end encrypted across Android and Chrome. On a new computer you unlock them with a Google Password Manager PIN or the screen lock of your Android phone.
- Third-party managers such as 1Password, Bitwarden and Proton Pass store passkeys too and sync them across the platforms they support. Since the November 2025 security update, Windows 11 can hand passkey requests to such managers directly, protected by Windows Hello.
Device-bound passkeys stay on one piece of hardware. Passkeys created with Windows Hello are stored on that PC. A hardware security key such as a YubiKey keeps passkeys inside the key and does not release the private key. A security key has room for a limited number of passkeys, and if you lose it, the passkeys on it are gone.
Where will I find my passkey?
In the password manager that saved it: the Passwords app on Apple devices, Google Password Manager on Android and in Chrome, or the manager you chose. The website shows the other half, usually under its security or sign-in settings, with the device or manager name next to each passkey.
How do passkeys work across devices?
There are two different things people mean by this.
The first is sync. A passkey saved to iCloud Keychain, Google Password Manager or a third-party manager appears on every device signed in to that account or app. You use it there like any other saved login.
The second is signing in on a computer that does not have your passkey, such as a friend's laptop or a work PC. The FIDO standard calls this the hybrid transport. The computer shows a QR code, you scan it with your phone, and Bluetooth checks that the phone is physically near the computer. The two then talk through an encrypted tunnel, and the phone does the signing. The passkey does not get copied to the computer, so nothing stays behind when you leave.
Can I move passkeys to another password manager?
Yes, increasingly. FIDO published a common Credential Exchange Format for moving passwords and passkeys between managers. Apple's operating systems from version 26 can import and export passkeys between password managers, and 1Password and Bitwarden were among the first apps to support the new standard on iOS. The transfer protocol itself is still a draft, so support differs from app to app.
Passkey vs password: what actually changes
Passkey vs password in one table:
| Risk | Password | Passkey |
|---|---|---|
| Fake login page | You type it in and it is gone | Not offered on the wrong address |
| Website database leak | Hashes can be cracked offline | Only public keys, useless for logging in |
| Reuse on other sites | One leak opens every site with the same password | A separate key for every site |
| Guessing | Common and short passwords fall first | Nothing to guess |
| Malware on your device | Can steal saved passwords | Can abuse saved passkeys, shown in 2026 research |
| Stolen session after login | Not protected | Not protected either |
| Works everywhere | Every site | Only sites that added passkeys |
The passkeys vs passwords difference comes down to one point: a password is a secret you share with the site and can be tricked into sharing with someone else, while a passkey proves you hold a secret without ever sending it.
Are passkeys safe? Pros and cons
Are passkeys safe? Against phishing, leaked databases and password reuse, yes, far safer than passwords. They still have limits worth knowing before you delete every password.
Advantages of passkeys
- Phishing pages get nothing, because there is nothing to type.
- Website breaches stop exposing your login. A stolen table of public keys does not open any account.
- No reuse and no weak choices. Every passkey is strong and unique by construction.
- Faster sign-in. A glance or a touch replaces typing and copying codes.
- Better privacy between sites, since each site gets a different key.
Disadvantages and real risks
The old way in can stay open. An account can keep the password, a text message code or an email link as a backup after you add a passkey. In August 2025 Proofpoint researchers showed a phishing kit that pretends to be a browser without passkey support, a form of user-agent spoofing, so the site falls back to the weaker method, which the kit can then phish. They had not seen it used in real attacks. An account is only as strong as its weakest way in, so remove the password where the site allows it and pick the strongest backup it offers.
A stolen session bypasses any login. After you sign in, the site gives your browser a session cookie. A phishing proxy or malware that steals that cookie walks in without needing your password or your passkey. Chrome is adding a defence called Device Bound Session Credentials, which ties the session to a key in the computer's hardware. It works in Chrome on Windows and is on by default for Google Workspace accounts.
Malware on the device is the main exception. Can passkeys be hacked? In September 2025 FIDO said no report had found a flaw in the cryptography or the standards behind passkeys, and the research that followed did not break the cryptography either. It showed what an attacker who already has a foothold on a computer can do. In August 2026 Unit 42 at Palo Alto Networks showed attacks on passkeys synced through Google Password Manager in Chrome on Windows, including extracting all of a user's synced passkeys. The same month SpecterOps showed that Windows 11 had been writing complete passkey sign-in responses to an event log that other users of the computer could read, which Microsoft fixed in July 2026. Both need access to the computer first: malware already running on it, or another account that can read its logs. So can passkeys be stolen? From a compromised computer, in some cases. From a website or a phishing page, no.
Synced passkeys depend on the account that syncs them. Whoever gets into your Apple Account, Google Account or password manager, and can pass its device check, gets your passkeys too. FIDO's own passkey page says that passkeys synced across devices are vulnerable to theft, while device-bound passkeys offer a hardware-backed root of trust. For a bank or an email account that guards everything else, a hardware security key is the stricter choice.
Not every site supports passkeys yet, and moving them between ecosystems is only now becoming routine.
What happens if you lose your phone?
With synced passkeys, very little. Sign in to your Apple Account or Google Account on a new device and confirm it: Apple accepts another device you own or your old device's passcode, Google accepts your Google Password Manager PIN or your Android screen lock. The passkeys then come back. Apple can also restore iCloud Keychain without any old device, using the account password, a code sent to your phone number and a device passcode. After that, remove the lost device's passkeys from your important accounts.
With a device-bound passkey, losing the device means losing that passkey. That is why the standard advises sites to let you register more than one, and why anyone using a hardware security key should register a second key as a spare and keep another sign-in method that only they control.
Passkey vs 2FA, authenticator apps and security keys
Passkey vs 2FA is a common question because a passkey does the job of both steps at once. It proves you have the device, and the face, fingerprint or PIN check proves it is you. A site can treat a passkey sign-in as meeting its two factor authentication requirement and skip the extra code.
Passkey vs authenticator app: a six-digit code from an app is far better than a text message, because it is not tied to your phone number and cannot be redirected with a SIM swap. But you still type the code, so a convincing fake page can collect it in real time. A passkey has no code to type, which is the difference that matters against phishing.
Passkey vs security key: a hardware security key is one place a passkey can live. Passkeys on a security key are device-bound, cannot be synced or copied off, and need the key plugged in or tapped. That makes them the strictest option and the least convenient one. Synced passkeys in a phone or password manager trade some of that strictness for easy recovery.
How to use passkeys
How to use passkeys day to day is simpler than the theory. Look for a passkey option in the security or sign-in settings of the accounts that matter most: your email, your Apple, Google or Microsoft account, your bank and your gaming accounts. PlayStation, Nintendo and Roblox all support passkeys. New Microsoft accounts have been passwordless by default since May 2025, and Google offers to skip the password when a passkey is available.
Keep a password manager for the sites that still want a password, and give each of those a different long password. The packet.guru password generator makes them in your browser. Then look at each important account's backup methods, because that is where a passkey account is weakest.
Watch the video version
This article goes deeper into storage, recovery and the 2025 to 2026 attack research. The video tells the wider story in fourteen minutes: why the old password rules were dropped, how accounts are really stolen, which second steps fail against phishing, and where passkeys fit among them.
FAQ
Can I still use my password if I have a passkey?
Yes, as long as the site keeps your password as a backup. Google lets you turn off the option that skips the password, and Microsoft lets you delete the password entirely. Leaving the password in place keeps a phishable way into the account, so remove it once the passkey works on all your devices.
What is a passkey PIN?
It is the PIN that unlocks passkeys when the device has no fingerprint or face sensor, or when you prefer not to use them. On a phone it is the screen lock. Google Password Manager asks for its own PIN when you set up passkeys on a new computer. A hardware security key has a PIN of its own, set on the key.
Can passkeys be shared?
Apple lets you share passwords and passkeys with a group of trusted contacts and send a single passkey to a nearby device with AirDrop. Sharing copies the private key to another person's manager, so share only with people who should have full access to the account.
Do I need a separate passkey for every device?
Not with synced passkeys: one passkey in iCloud Keychain, Google Password Manager or a third-party manager works on every device signed in to it. Device-bound passkeys, such as those on a security key or in Windows Hello, are one per device, so add one for each device you use.
Is a passkey the same as Sign in with Google?
No. Sign in with Google or Apple lets a website trust another company to vouch for you. A passkey is a key that belongs to your account on that website alone, and no third party takes part in the sign-in.
Sources
- Web Authentication: An API for accessing Public Key Credentials, Level 3 (W3C)
- Passkeys (FIDO Alliance)
- About the security of passkeys (Apple Support)
- Pass the Passkey: A Novel Attack Surface in Passwordless Authentication (Unit 42, Palo Alto Networks)