What are passkeys?

Passkeys are a new, more secure way to sign in to websites and apps without a password. Instead of remembering and typing a password, you use your fingerprint, face recognition or your device PIN to sign in. Passkeys are created and stored on your device automatically, and they work seamlessly with your phone, tablet or computer.

This technology was developed by major tech companies such as Apple, Google and Microsoft together with the FIDO Alliance. The goal is to fully replace passwords (with all their problems, such as being forgotten, stolen and hacked) with a safer and more user-friendly method.

Why are passkeys better than passwords?

We all know passwords, but they have many drawbacks. Passkeys solve these problems.

Problems with passwords

  • Hard to remember: Especially if you use strong, unique passwords.
  • Often reused: People use the same password for multiple sites.
  • Vulnerable to phishing: You can be tricked into entering your password on a fake site.
  • Can be stolen: Through data breaches or malware.
  • Easy to guess: Many people choose predictable passwords.

Benefits of passkeys

  • Nothing to remember: Your device and biometrics do all the work.
  • Unique per site: Each passkey only works for one specific website.
  • Phishing-resistant: Passkeys only work on the real website, never on a copy.
  • Cannot be stolen: There is no password that can be leaked.
  • Faster sign-in: A tap or a glance is enough.

How do passkeys work technically?

To understand passkeys, it helps to know what happens behind the scenes. But don't worry: you don't need to remember any of this to use passkeys.

The principle explained

When you create a passkey, your device generates two digital keys:

  1. A private key: This stays safely stored on your device and never leaves it.
  2. A public key: This is sent to the website and stored there.

When you sign in, your device proves that it holds the private key without actually sending it. This is similar to how you can prove that you signed a certain document without having to show the document itself.

Security with biometrics

The private key is protected by your device's security method:

  • Fingerprint (Touch ID or fingerprint sensor)
  • Face recognition (Face ID)
  • Your device PIN or password

Even if someone steals your phone, they can't use your passkeys without your fingerprint or face.

Syncing passkeys between devices

A common question is what happens if you have multiple devices or buy a new one.

Automatic syncing

Passkeys are synced automatically within your ecosystem:

  • Apple devices: Passkeys are stored in iCloud Keychain and are available on all your iPhones, iPads and Macs.
  • Android devices: Passkeys are stored in your Google account and are available on all your Android devices.
  • Windows: Passkeys are stored in Windows Hello and can be synced through your Microsoft account.

Using passkeys on other devices

Want to sign in on a computer that isn't yours? You can do that too:

  1. The website offers the option to sign in with a passkey.
  2. You choose to sign in with another device.
  3. A QR code appears on the screen.
  4. You scan this code with your phone.
  5. Confirm with your fingerprint or face.
  6. You are signed in on the computer.

Setting up passkeys on iPhone and iPad

Apple has built passkeys into iOS. Here is how to set them up and use them.

Requirements

  • iPhone with iOS 16 or later, or iPad with iPadOS 16 or later
  • iCloud Keychain turned on
  • Two-factor authentication for your Apple ID

Checking iCloud Keychain

  1. Open the Settings app.
  2. Tap your name at the top.
  3. Tap "iCloud".
  4. Tap "Passwords and Keychain" or "Keychain".
  5. Make sure it is turned on.

Creating a passkey

  1. Go to a website that supports passkeys (for example Google, Microsoft or PayPal).
  2. Go to your account's security settings.
  3. Look for "Passkey" or "Passwordless sign-in".
  4. Tap "Create passkey" or something similar.
  5. Your iPhone asks you to confirm with Face ID or Touch ID.
  6. The passkey is saved to your iCloud Keychain automatically.

Signing in with a passkey

  1. Go to the website where you created a passkey.
  2. Tap "Sign in" or "Log in".
  3. The website recognizes that you have a passkey.
  4. A prompt appears asking you to sign in with your passkey.
  5. Confirm with Face ID or Touch ID.
  6. You are signed in right away.

Setting up passkeys on Android

Google has built passkeys into Android. It works in a similar way to iOS.

Requirements

  • Android 9 or later (Android 14 offers the best support)
  • Signed in to a Google account
  • Screen lock set up (PIN, pattern or biometrics)

Creating a passkey on Android

  1. Open Chrome or another supported browser.
  2. Go to a website that supports passkeys.
  3. Navigate to the security settings.
  4. Choose to create a passkey.
  5. Android asks you to confirm with your fingerprint or screen lock.
  6. The passkey is saved to your Google account.

Managing passkeys

  1. Open the Settings app.
  2. Go to "Passwords & accounts" or "Google".
  3. Tap "Password Manager" or "Passkeys".
  4. Here you can see all your saved passkeys.
  5. You can view or delete passkeys.

Setting up passkeys on Windows

Windows supports passkeys through Windows Hello. Here is how it works.

Requirements

  • Windows 10 or Windows 11
  • Windows Hello set up (PIN, fingerprint or face recognition)
  • Microsoft Edge or Chrome browser

Setting up Windows Hello

If you haven't set up Windows Hello yet:

  1. Open Settings from the Start menu.
  2. Go to "Accounts".
  3. Click "Sign-in options".
  4. Set up a PIN, fingerprint or face recognition.

Using passkeys in the browser

  1. Go to a website that supports passkeys.
  2. Choose to create a passkey.
  3. Windows asks how you want to verify.
  4. Choose "Windows Hello" or "This device".
  5. Confirm with your PIN, fingerprint or face.
  6. The passkey is saved.

Websites that support passkeys

More and more websites support passkeys. Here are some popular examples.

Major platforms with passkey support

  • Google: All Google services (Gmail, YouTube, Google Drive)
  • Microsoft: Microsoft accounts and Microsoft 365
  • Apple: Apple ID and iCloud
  • PayPal: Online payments
  • Amazon: Shopping and Prime Video
  • eBay: Online auctions and shopping
  • LinkedIn: Professional networking
  • GitHub: Software development
  • Nintendo: Gaming accounts
  • Uber: Rides and delivery

How do I know if a site supports passkeys?

Look in your account's security settings for terms like:

  • Passkey
  • Passwordless sign-in
  • Biometric sign-in
  • FIDO2 / WebAuthn

Tips for a smooth transition

You don't have to switch to passkeys overnight. Here are some tips.

Start with important accounts

Start by setting up passkeys for your most important accounts:

  1. Email accounts (Gmail, Outlook)
  2. Banking and financial services
  3. Social media
  4. Cloud storage

Keep passwords as a backup

Most websites let you keep both a passkey and a password. This is useful as a backup for situations where you don't have access to your devices with passkeys.

Inform family members

If you share devices or have a family account, explain how passkeys work. Everyone should set up their own passkeys on their own devices.

Frequently asked questions

What if I lose my phone?

If your passkeys are synced with iCloud or your Google account, you can restore them on a new device by signing in with the same account. No syncing? Then you can still sign in with your password (as a backup) and create a new passkey afterwards. That's why it's wise to keep your password until passkeys are more widely supported.

Can someone else use my passkeys?

No, passkeys are protected by your device's biometrics or PIN. Even if someone steals your phone, they can't sign in without your fingerprint, face or PIN. The private key also cannot be copied or exported.

Do passkeys work on all websites?

Not all websites support passkeys yet, but the number is growing fast. Major platforms such as Google, Microsoft, Apple and PayPal already support passkeys. Smaller websites are gradually following. You can use passkeys where available and keep using passwords for other sites.

Can I use passkeys on a public computer?

Yes, with the QR code method you can use your phone to sign in on any computer, including a public one. The passkey stays on your phone and is not transferred to the computer. After you close the browser you are automatically signed out and no sensitive information is left behind.

Looking for an email address? View our offer.