For decades the password has been the front door to almost everything we do online, and almost everyone agrees it is a bad door. We forget passwords, reuse them, write them on sticky notes, and hand them to convincing fake websites. Passkeys are the industry's serious attempt to replace that door entirely. Major platforms including Apple, Google, and Microsoft now support them, and thousands of websites let you sign in with one. If you have unlocked your phone with your face or fingerprint to log into an app, you may already have used a passkey without realizing it.
What a passkey actually is
A passkey is not a password you memorize. It is a pair of cryptographic keys created by your device. One key is public and lives on the website's server. The other is private and never leaves your phone, laptop, or hardware security key. When you sign in, the website sends a random challenge, your device signs it with the private key, and the site verifies the signature using the public key it already holds.
The important part is that the private key is never transmitted. A server breach cannot leak your passkey the way a leaked password database exposes millions of credentials, because the server only ever stored the harmless public half. To authorize the signing, your device asks you to prove you are present, usually with a fingerprint, face scan, or device PIN. That biometric data stays on the device too; it is only unlocking the key locally.
Why passkeys resist phishing
The single biggest advantage is that passkeys are bound to the exact website that created them. A passkey for your real bank simply will not work on a look-alike phishing page, because the browser checks the site's domain before signing anything. There is nothing to type, so there is nothing for a fake site to capture. This closes the door on the most common attack of all: tricking a human into entering real credentials somewhere fake.
Passkeys also remove entire categories of everyday risk:
- No password to reuse across sites, so one breach cannot cascade into others.
- No weak or guessable password, because there is no human-chosen secret.
- No credential to be read over your shoulder or captured by a keylogger.
- No one-time codes to be intercepted, since the check happens on your device.
How passkeys sync and travel with you
A common worry is losing access if your phone breaks. In practice, most passkeys are backed up and synced through your platform account. Apple syncs them through iCloud Keychain, Google through your Google account, and password managers like 1Password and Bitwarden store them too. Buy a new phone, sign into your account, and your passkeys reappear. For signing in on a device that does not have your passkey, such as a friend's computer, you can scan a QR code with your phone to approve the login over a local Bluetooth handshake.
If you prefer that keys never sync to the cloud, you can store them on a physical security key such as a YubiKey. These are popular with journalists, activists, and high-risk professionals who want a key that exists only on hardware they physically control.
How to start using passkeys
You do not have to switch everything at once. A reasonable path looks like this:
- Check whether your main accounts support passkeys, usually under Security or Sign-in settings. Google, Amazon, PayPal, and many others already do.
- Create a passkey on a device you trust and use often, such as your primary phone.
- Keep your old password enabled as a backup at first, until you are comfortable.
- Make sure your device backups are working, so a lost phone does not mean lost access.
- Consider adding a second passkey, on a laptop or a hardware key, for redundancy.
The realistic limitations
Passkeys are not yet everywhere, and support across older browsers and niche services is uneven. Sharing an account, such as a family streaming login, is still awkward with device-bound keys. And because the system leans on your device and platform account, protecting that account with a strong recovery method matters more than ever. Even so, the direction is clear. Passkeys make the easy thing and the secure thing the same action, which is exactly what password security never managed to do.