Most of us have typed a password hundreds of times, reused one we shouldn’t have, and clicked a “forgot password” link more often than we’d like to admit. Passkeys are the technology industry groups are pushing to replace that routine. This guide explains what a passkey is, how it works in plain language, how it compares with a password, and how to start using one.
What is a passkey?
A passkey is a sign-in credential that replaces your password. According to the FIDO Alliance, the industry body that develops the standard, passkeys are based on FIDO authentication and are designed to be always strong and resistant to phishing, unlike passwords.
Instead of a secret word you type, a passkey is a pair of cryptographer keys. You never see them or memorize them. You unlock them with something you already use on your device, such as a fingerprint, face scan, or device PIN.
How do passkeys work?
Two keys instead of one shared secret
When you create a passkey for a website or app, your device generates a key pair that is unique to that service. The FIDO Alliance explains that the device keeps the private key and registers only the public key with the online service. Because there is no shared secret stored on the service, there is nothing reusable for an attacker to steal from a database.
Signing in
When you sign in, the service sends your device a challenge. Your device proves it holds the private key by signing that challenge, but only after you approve the sign-in locally with a bio-metric, a device PIN, or a touch of a security key. Your fingerprint or PIN is used to unlock the key on your device; it is not sent to the website.
Why a fake website cannot use your passkey
A passkey is tied to the website it was created for. If you land on a look-alike phishing page, your device will not offer a passkey for it, and there is no password for you to type into the fake page. This is why the FIDO Alliance describes passkeys as phishing-resistant, and why the same standard is also described as protecting against credential stuffing, where attackers try stolen passwords on many sites.
Passkeys vs passwords
| Password | Passkey | |
|---|---|---|
| What you use | A secret you remember or store | A key pair unlocked by bio-metric, PIN or security key |
| Can it be phished? | Yes, if you type it into a fake site | Designed to resist phishing |
| Reuse across sites | Common and risky | Unique per service |
| What the service stores | Usually a hashed password | Only a public key |
| Strength | Depends on your choices | Always strong, per the FIDO Alliance |
Synced vs device-bound passkeys
Passkeys come in two broad forms. Synced passkeys are available across your devices, so a new phone can use your existing passkeys without re-enrolling every account. Device-bound passkeys stay on one device or security key, which some organizations prefer when they do not want credentials to sync. The FIDO Alliance describes both options.
Are passkeys safe?
For the threats they target, phishing and password theft, passkeys are a significant improvement. They are not a cure-all. Editor’s analysis, not a FIDO claim:
- If your passkeys sync through a cloud account, the security of that account (its own sign-in and recovery process) matters a great deal.
- Anyone who can unlock your device and approve a prompt may be able to use your passkeys, so keep a strong screen lock.
- Not every website supports passkeys yet, and some still require a password as a fallback.
How to start using passkeys
- Pick one important account, such as your email, and open its security or sign-in settings.
- Look for an option such as “create a passkey” or “sign in with a passkey.” The wording varies by service.
- Approve the prompt with your fingerprint, face, or device PIN.
- Test signing in with the passkey before relying on it.
- Keep a recovery method current, and note which accounts still need a password.
- Repeat for your other critical accounts over time.
Frequently asked questions
Is a passkey the same as a password? No. A password is a secret you share with the service. A passkey uses a key pair, and the private key stays on your device.
Do I need a special device? Passkeys work with bio-metrics, a local PIN, or a FIDO security key, so there are several ways to unlock them.
What if I lose my phone? With synced passkeys, they are available again once you sign in to your account on a new device. Setting up account recovery in advance is the key step.
Can I still use a password manager? Many password managers are adding passkey storage. Check your provider’s current documentation.
Sources
-
- FIDO Alliance, “How FIDO Works”: https://www.fidoalliance.org/how-fido-works
- FIDO Alliance, “Passkeys”: https://fidoalliance.org/