Privacy & Security

Passkeys Explained: What They Are and How to Switch

By Camille Laurent / November 11, 2026

Quick answer: A passkey is a replacement for a password. Instead of typing a secret you have to remember, you approve the sign-in on your device with the same fingerprint, face scan or PIN you use to unlock it. Behind the scenes, your device holds a private key that never leaves it, and the website holds a matching public key. To switch, sign in to an account the usual way, find the “create a passkey” option in its security settings, and make sure you can sign in from a second device before you drop the old password.

Key takeaways

A passkey is a pair of cryptographic keys tied to your account on one site or app. There is no shared secret for an attacker to steal and reuse.
You unlock a passkey with your device’s own method: biometrics, a PIN, a pattern or the device password. According to the FIDO Alliance, biometric checks stay on the device.
Passkeys can sync through a platform account or a third-party password manager, or stay locked to a single device like a hardware security key.
Losing a phone is usually fine if your passkeys sync. Losing the account that syncs them is the real risk, so set up recovery first.
Menus vary by version, device and website. Treat the steps below as the general shape and follow your platform’s current help page.

What a passkey actually is

Think of the old way as a shared secret: you and the website both know the password, and anyone who learns it can pose as you. A passkey flips that. When you create one, your device generates two linked keys. The website stores the public one, which is useless on its own. Your device keeps the private one and uses it to prove it is you without ever revealing it. Apple’s support documentation describes the same arrangement: the server holds the public key, and the private key stays on your device.

The FIDO Alliance, the industry group behind the standard, describes a passkey as a credential based on FIDO standards, built on FIDO2, which combines two specifications called WebAuthn and CTAP. Each passkey is tied to your account on a particular site or app. When you sign in, you approve the request on your device, and the site receives a cryptographic confirmation instead of a password.

Why that makes phishing harder

Phishing works by tricking you into typing a password into a lookalike page. With a passkey there is no password to type, and the FIDO Alliance notes that because nothing shared is exchanged, there is no sign-in data an attacker can steal and reuse. Apple makes the same point, saying passkeys resist phishing because no shared secret is sent. That is not immunity from every scam, but it closes one common door.

What about my fingerprint or face?

The biometric part is only the unlock step on your own device. FIDO says biometric data stays on the device and is not sent to a remote server. The site only learns that the check passed.

Where passkeys live and how they sync

This is the part that confuses people, so here is the simple version. A passkey has to be stored somewhere, and there are three common homes.

A platform account or manager. Apple’s iCloud Keychain syncs passkeys across your Apple devices, end-to-end encrypted, with keys Apple says it does not hold. Google’s help pages say passkeys saved to Google Password Manager go to your Google Account and are available on devices where you are signed in. Microsoft’s support page lists Microsoft Password Manager among the places you can save a passkey.
A third-party password manager. The FIDO Alliance says passkeys can sync through a passkey provider, either a platform credential manager or a third-party password manager, as long as you are signed in to that provider on each device. Google’s and Microsoft’s pages also mention that a passkey may be saved in a third-party credential manager.
A single device. Passkeys can also be device-bound, which means they never leave one device. A hardware security key is the classic example, and Microsoft’s page lists a physical security key as a save option. On Windows, a passkey saved with Windows Hello is stored locally on that PC.

None of these is “the right one” for everybody. Synced options are convenient and easier to recover; device-bound options keep the key in one place but need a backup plan.

How to create a passkey (the general steps)

Every site is a little different, and menus vary by version, so use this as a map rather than a script.

Set up your device unlock first. You need a screen lock, such as a PIN, fingerprint or face unlock, before you can create or use a passkey. Google and Microsoft both say so.
Check your platform requirements. Apple says your Apple Account needs two-factor authentication, and Google notes iCloud Keychain should be turned on if you use Apple devices.
Sign in the usual way to the account you want to upgrade, then open its security or sign-in settings.
Choose the option to create a passkey. Wording differs. Microsoft’s flow, for example, has you add a new sign-in method from your account security settings and then confirm where to save it. Google has you pick “Create a passkey” and unlock your device when prompted.
Confirm the save location. Your device may offer a password manager, a phone or tablet (often by scanning a QR code), a security key or, on Windows, Windows Hello. Choose the one that fits your plan.
Test it. Sign out, then sign back in with the passkey. Do it again on a second device if you can.

What happens if you lose your phone

Take a breath. If your passkeys sync, the FIDO Alliance says you can set up your provider on a new device and get them back. Apple notes that your other devices keep your passkeys, and that if you lose all devices you can recover the keychain with your iCloud credentials, a code sent to your registered phone number and your device passcode. Apple also says the number of recovery attempts is limited, so do not guess.

If a passkey is device-bound, it cannot be pulled back from a lost device. In that case, the FIDO Alliance says a site will typically fall back to another sign-in method, such as a password, and that a FIDO security key can act as a recovery credential if you have lost every device that held your synced passkeys.

Google’s help page adds a practical step for a lost device: sign in to your Google Account on another device and remove the passkey tied to the lost one. If you also use a third-party credential manager, check there too.

Do the prep before you need it

When you still need a password

Passkeys are spreading, but they are not universal yet. Plan to keep passwords in a few situations.

A site or app that does not offer passkeys yet. No passkey option in the security settings usually means no support.
A work or school account. Microsoft’s page says these can use passkeys only if your organization allows it, and it may limit where they can be saved.
Signing in on a new device before your passkey provider is set up there. Apple’s documentation says a new device requires your Apple Account password and a verification code.
Recovery. Do not delete your old sign-in method until you are sure the passkey works everywhere you sign in.

Limits and gotchas

Situation	What to know	What to do
Passkey saved on one device only	Device-bound passkeys cannot be recovered from a lost device	Register a backup, such as a second device or a security key
Provider account locked or lost	You may lose access to every synced passkey at once	Keep the provider’s recovery methods current
Switching ecosystems	Passkeys sync within a provider, so moving from one platform to another needs planning	Create new passkeys with the manager you plan to keep, and keep a backup sign-in until then
Work or school account	Organization policy may limit passkeys	Ask your IT team
No screen lock on the device	Passkeys need a device unlock method	Set a PIN, fingerprint or face unlock first
Expected save option missing	Microsoft says the Windows Hello option may not appear if you already saved a passkey to a synced manager	Pick another listed save location, or remove the earlier one if you prefer
Suspicious passkey on an account	Google says it disables a passkey it flags as suspicious and gives you 30 days to confirm it	Review the notice and confirm only if you recognize it

Your switch checklist

Turn on a screen lock on every device you plan to use.
Decide where your passkeys will live: a platform account, a third-party manager or a security key.
Update recovery options for that platform account (phone number, recovery contact, backup device).
Start with the accounts that matter most, such as email, banking and your main platform account.
Create the passkey, then sign out and test it.
Test sign-in on a second device or with a backup method.
Keep your old sign-in method until the new one is proven.
Remove old passkeys for lost or retired devices.

Frequently asked questions

Is a passkey the same as a password manager?

No. A password manager stores credentials, and many can now store passkeys too. A passkey is the credential itself: a key pair for one account. The FIDO Alliance describes password managers as one kind of passkey provider that can sync them.

Can I use my phone’s passkey to sign in on a computer?

Often, yes. Microsoft’s help page describes saving a passkey on a phone or tablet by scanning a QR code, and Google notes that Bluetooth should be on to sign in to a computer with a phone’s passkey. Exact options depend on your devices and the site.

If someone gets my phone, can they sign in as me?

The sign-in has to be approved with your device’s unlock method, per the FIDO Alliance. So a strong screen lock matters more than ever. If a device goes missing, remove its passkeys from your accounts from another device.

Do I have to give up my password completely?

Not necessarily. What a site allows varies, so check each account’s security settings and keep a recovery method until you are comfortable.

Before you decide

Passkeys are a sensible upgrade for most accounts, mainly because they take the typing, reusing and phishing risks out of passwords. But the switch works best when you plan for the unglamorous part: where the passkey lives and how you get back in if your phone ends up in a lake. Pick your storage, set up recovery, switch one important account, test it, then repeat. Menus vary by version, so check your platform’s current help page if a screen does not match.