What Are Passkeys? The Password Replacement, Explained Simply

Passkeys let you sign in with your face, fingerprint or phone PIN instead of a password, and they can't be phished. Here's how they work and how to start.

By
Published 5 min read
Checked against 3 sources
Illustration: What Are Passkeys? The Password Replacement, Explained Simply

The short answer

A passkey is a way to sign in without a password. Your device creates a unique digital key for each site and unlocks it with your fingerprint, face or screen lock. Because there's no password to type or steal, passkeys protect you against phishing. Turn them on first for your Google, Apple, Microsoft and banking accounts where offered.

Passwords have two big weaknesses: people reuse them, and people can be tricked into typing them into fake websites. Passkeys fix both by removing the password entirely.

Passkeys are based on standards from the FIDO Alliance, an industry group that includes Apple, Google and Microsoft, and they’re now supported by many major websites and apps.

How passkeys work, in plain English

When you create a passkey for a website, your device makes a matching pair of digital keys:

  • One key stays on your device (or in your password manager), protected by your fingerprint, face or screen-lock PIN.
  • The other key goes to the website. It’s useless on its own, so a data breach at the website doesn’t expose anything that could sign you in.

When you sign in, the website asks your device to prove it has the right key. You approve with your fingerprint or face, and you’re in. You never type a password.

Why passkeys are safer

  • They can’t be phished. A passkey only works on the real website it was created for. A fake login page can’t use it, even if it looks identical.
  • Nothing to reuse or leak. Each passkey is unique to one site.
  • Nothing to guess. There’s no password for attackers to try.
  • Built-in two-factor: you need your device and your fingerprint, face or PIN.

Where to start

Look for “passkeys” in the security settings of your most important accounts:

  1. Google: sign in to your Google Account, open Security, and find Passkeys.
  2. Apple Account: passkeys work through iCloud Keychain on Apple devices.
  3. Microsoft: look under Security in your Microsoft account.
  4. Banks, shopping and social media: many now offer passkeys in their app or website security settings.

When a site offers to create a passkey, accept it on the device you use most. It will sync to your other devices if you use iCloud Keychain, Google Password Manager or a compatible password manager.

Things to know

  • Keep a backup sign-in method (like a recovery phone number or backup codes) on important accounts.
  • Shared devices: don’t create passkeys on a computer other people use without their own screen lock.
  • Not everywhere yet: keep using a password manager and strong passwords for sites without passkeys.

For accounts that don’t support passkeys yet, use strong, unique passwords and two-factor authentication.

The bottom line

Passkeys are the easiest security upgrade most people can make: faster to use than passwords and much harder to steal. Turn them on for your email and banking first, and accept them whenever a site offers.

Frequently asked questions

If I lose my phone, do I lose my passkeys?

Usually not. Passkeys saved in Apple's, Google's or a password manager's account sync across your devices and can be restored when you sign in on a new one. Keep a backup sign-in method on important accounts too.

Can a scammer steal a passkey with a fake website?

Passkeys are designed to resist phishing. A passkey only works on the real website it was created for, so a look-alike site can't use it.

Do I still need passwords?

For now, yes. Many sites don't support passkeys yet, and some keep a password as a backup. Keep using strong, unique passwords and a password manager alongside passkeys.

Why you can trust this guide
  • Based on official sources. The steps here are checked against the 3 official sources listed below, such as the help pages of the companies involved.
  • Checked and dated. Last checked on November 10, 2026. We update guides when software or advice changes.
  • Independent. No company paid for or reviewed this guide. We don't sell products, and ads never influence our advice.
  • Open to corrections. Spotted an error? Tell us and we'll fix it. Read how we research.

Sources

  1. FIDO Alliance — Passkeys
  2. Google Account Help — Sign in with a passkey instead of a password
  3. CISA — Turn On Multifactor Authentication

This guide is general information. Menus and features can change with software updates, and steps may differ on your device or version. Back up important data before making big changes. Read our disclaimer.

Keep reading