What is a passkey — and should you use one instead of a password?
- Written by: The Times
Websites increasingly invite users to create a passkey. The unfamiliar name describes a simpler way to sign in, with stronger protection against some of the internet’s most common attacks.
For years, the instructions were familiar.
Choose a username. Create a password. Include a capital letter, a number and a symbol. Remember it — and do not use it anywhere else.
Then came verification codes sent by text message or generated in an app.
Now another option is appearing: “Create a passkey.”
For anyone already managing dozens of online accounts, that can sound like another complication.
Yet passkeys are intended to make signing in easier. On a compatible device, accessing a website can become much like unlocking your phone.
What is a passkey?
A passkey is a digital credential that lets you sign in to a supporting website or app without typing a conventional password.
You approve its use through your device, usually with facial recognition, a fingerprint or the device’s PIN or passcode.
The passkey itself is not your face, fingerprint or PIN. Those are ways of unlocking permission to use it. The FIDO Alliance, which develops the underlying authentication standards, describes passkeys as a replacement for passwords using these familiar device security methods.
There is no new collection of letters and symbols to memorise.
You may still need to identify your account with an email address or username, although some services let you select the account directly from a passkey prompt.
How does it work?
When you create a passkey, the system generates two mathematically related cryptographic keys.
One is a public key, which the website stores. The other is a private key, held securely by your device or passkey manager.
When you return, the website sends a challenge. After you authorise the sign-in, your device uses the private key to produce a response that the website can verify with its public key.
The private key is not sent to the website. There is no reusable password passing from your keyboard to the service.
The mathematics happens in the background. What you see may be little more than a request to use Face ID, Touch ID or your screen lock.
Why are websites introducing them?
Passwords have persistent weaknesses.
People reuse them. Criminals steal them. Fake websites persuade users to enter them. A password exposed through one business can then be tried against accounts elsewhere.
Passkeys address several of these problems.
Each credential is associated with the relevant service, and its use is checked against the website’s identity. A lookalike phishing website cannot simply request the passkey belonging to the genuine website.
A stolen database of public keys also does not give criminals the private keys needed to sign in. These properties make correctly implemented passkeys strongly resistant to phishing and password reuse attacks.
For users, the attraction is convenience. For website operators, it is a way to reduce account theft and password-related problems.
Does the website receive my face or fingerprint?
No. Using facial recognition or a fingerprint to authorise a passkey does not send that biometric information to the website.
The biometric check happens on your device. Google, for example, explicitly states that the biometric data used for its passkey sign-ins stays on the device and is not shared with Google.
This distinction matters.
Your face unlocks the use of the credential. It is not uploaded as your new website password.
What happens on an iPhone or iPad?
Apple supports passkeys through iCloud Keychain.
On a supporting website or app, you can accept the offer to create a passkey and authorise it using the device’s security prompt.
With iCloud Keychain enabled, passkeys can be made available across compatible Apple devices signed in to the same Apple Account. A passkey created on an iPhone can therefore also be available on an iPad.
Apple says its passkeys are encrypted, and using its iCloud Keychain passkey system requires two-factor authentication for the Apple Account.
Android users and people using other platforms have corresponding options, including Google Password Manager and compatible third-party password managers.
Where you save the passkey matters: it determines how you access it again and which devices can use it.
How do I create one?
The exact process varies, but it commonly follows these steps:
- Open the genuine website or official app and sign in.
- Find the account’s security or sign-in settings.
- Select “Create a passkey” or accept the service’s invitation.
- Check which device or password manager will save it.
- Approve the request using your device’s security prompt.
- Test the new sign-in method before changing other access arrangements.
Microsoft’s guidance confirms that supporting services may offer a choice of a synced password manager, a security key or another device. If the service does not support passkeys, the option will not be available.
There is no need to convert every account in one sitting. Starting with one familiar service makes the process easier to understand.
What if I lose my phone?
This is the question to resolve before relying on any new sign-in method.
Some passkeys synchronise through a password manager, allowing access from another approved device. Others are tied to a particular device or physical security key.
A synced passkey is therefore different from a credential whose only copy is on a lost device.
Britain’s National Cyber Security Centre notes that non-synchronised credentials cannot be recovered from a lost device or token unless another authentication method has already been registered.
Before switching, check:
- Where the passkey is saved.
- Whether it is available on another trusted device.
- How to recover the password-manager account.
- Which backup sign-in methods the website permits.
- Whether recovery details are current.
A backup route should be something you understand and can actually use.
Can I still use another computer?
Often, yes.
Compatible services can let you use a passkey stored on your phone to approve a sign-in on a nearby computer. This commonly involves scanning a QR code and confirming on the phone, with Bluetooth used to establish proximity.
The passkey can remain on your phone rather than being saved to the computer. Apple documents this option for computers that are not associated with your Apple Account.
That is different from creating and saving your personal passkey on someone else’s device.
Use your own trusted device or credential manager for storage, and sign out when finished on a borrowed computer.
Does creating a passkey delete my password?
Not necessarily.
Services handle the transition differently. Google says adding a passkey does not remove the account’s existing authentication or recovery methods.
Australia’s myGov offers passkeys and allows users to turn off password sign-in after creating one, while explaining that the password remains necessary for some settings and recovery purposes.
Read the particular service’s instructions before deleting passwords or removing backup methods.
If password sign-in remains available, that password should still be strong and unique.
Should I use one?
For most people using a supported service on a personal, well-protected device, a passkey is a sensible improvement.
It can reduce typing, eliminate the need to remember another password and provide stronger protection against fake login pages.
It does not make an account immune to every attack. Device security, account recovery and the service’s other login methods still matter.
Anyone who can unlock your device may be able to use credentials stored on it. Google specifically warns users to create passkeys only on devices they personally own and use.
Keep your device updated, protect its passcode and understand your recovery arrangements.
The Times view
Passkeys ask users to learn an unfamiliar name for a process that can be easier than the one it replaces.
The practical approach is gradual: create a passkey on a trusted device, understand where it is saved, test it and confirm how you would regain access if that device disappeared.
Once those questions are answered, signing in can become a familiar glance at a screen or touch of a finger — without another password to remember.
