What Is a Passkey and How Does It Work?

A passkey is a cryptographic credential tied to one of your accounts that your phone or computer creates and uses on your behalf, instead of a password you type. It works by generating a linked pair of keys — one private, one public — and proving who you are through math your device does automatically, rather than through a secret you memorize and hand over at login. The standard behind them comes from the FIDO Alliance; for how they compare on data collection, see our look at whether passkeys are more private.

What is a passkey and how does it replace passwords?

The FIDO Alliance, the industry group that designed the standard behind passkeys, describes them plainly: "Passkeys are FIDO cryptographic credentials that are tied to a user's account on a website or application. With passkeys, users no longer need to enter usernames and passwords or additional factors." That's the whole pitch. Instead of a secret you memorize and type into a login box, a passkey is a pair of mathematically linked keys generated by your device the first time you set one up with a site.

Google's developer documentation explains the mechanism in more detail: "When a user creates a passkey with a site or application, this generates a public–private key pair on the user's device. Only the public key is stored by the site, but this alone is useless to an attacker," according to Google's passkeys documentation for developers. The private half of that pair is the part that actually proves who you are, and it never gets handed over to anyone — not even the site you're logging into.

How do passkeys work, mechanically?

Microsoft's explanation of the underlying FIDO protocols lays out the sequence step by step: "When a user registers with an online service, their client device generates a new key pair. The private key is stored securely on the user's device, while the public key is registered with the service. To authenticate, the client device must prove that it possesses the private key by signing a challenge. The private keys can only be used after they're unlocked by the user using the Windows Hello unlock factor (biometrics or PIN)," per Microsoft Learn's documentation on Windows passkey support.

In practice, "signing a challenge" means the website sends your device a one-time puzzle, and only your private key can produce the correct answer. Your device does that math locally and sends back proof — not the key itself. The service checks that proof against the public key it already has on file. If it matches, you're in.

That same Microsoft Learn page addresses a common worry directly: your fingerprint or face scan isn't what gets sent over the internet. "Additionally, any biometric information used in the authentication process remains on the user's device and isn't transmitted across the network or to the service," according to Microsoft Learn's documentation on Windows passkey support. Your face or fingerprint is just the thing that unlocks your device's private key locally — it's not the credential, and it's not shared with the website or with Microsoft. Google says the same thing about its own system: "Your biometric data is stored on your device and isn't shared with Google," according to Google's Chrome passkey support page.

Why can't passkeys be phished like passwords?

A password works anywhere you type it — which is exactly the problem. A convincing fake login page can trick you into typing your real password, and the attacker now has it. Passkeys are built so that trick doesn't work.

Google puts it this way: "Because passkeys are bound to a website or app's identity, they're resistant to phishing attacks. The browser and operating system ensure that a passkey can only be used with the website or app that created them," according to Google's developer documentation. Chrome's own help page describes the practical effect for users: "Passkeys are connected to the app or website they were created for, so you can never be tricked into using your passkey to sign in to a fraudulent app or website," per Google's Chrome Help center.

Microsoft frames it as removing the human from the verification step entirely: "Passkeys are enforced by the browsers or operating systems to only be used for the appropriate service, rather than relying on human verification," according to Microsoft Learn. With a password, you're the one who has to notice the fake URL. With a passkey, the software checks the site's identity before it will even offer to sign in — a real passkey for your bank simply won't appear, or work, on a copycat page.

How do passkeys sync across my devices?

Passkeys aren't necessarily locked to one gadget. Depending on the platform, they can follow you to your other devices through encrypted sync.

On Apple devices, the Passwords app stores them and keeps them backed up: "The Passwords app supports the storage of passkeys—an advanced digital key that enhances security by using public-key cryptography, making them more secure and convenient than traditional passwords. For added security, iCloud Keychain helps protect all credentials stored within the app, ensuring that the data is encrypted and synchronized across the user's Apple devices," according to Apple's support documentation. That means a passkey you create on your iPhone can also show up on your iPad or Mac, as long as they're signed into the same Apple ID with iCloud Keychain turned on.

Google's version works similarly across Android and Chrome: "Passkeys saved with Google Password Manager are available across your devices. You can use them on all platforms where Chrome is available when you're signed in with the same Google Account," according to Google's Chrome Help page.

Microsoft's own technical description draws a line between two kinds of passkeys that's worth understanding: "Device-bound passkeys stay on a single physical device and never leave it. Synced passkeys are encrypted and available across all devices linked to a cloud provider," per Microsoft Entra's documentation. Notably, that same page states that Microsoft's own Authenticator app can't yet be used to create passkeys: "Registering passkeys through the Microsoft Authenticator app isn't currently supported. Use Windows Hello, FIDO2 security keys, iCloud Keychain, Google Password Manager, 1Password, or Bitwarden instead." So on Windows, a passkey tied to Windows Hello generally stays on that one PC unless you've saved it to a syncing service like iCloud Keychain or Google Password Manager instead.

There's also a cross-device option that doesn't require syncing at all. Google explains: "Passkeys available on phones can be used when logging into a laptop, even if the passkey isn't synchronized to the laptop, as long as the phone is near the laptop and the user approves the sign-in on the phone," according to Google's developer documentation. That's the mechanism that lets you approve a sign-in on your computer using your phone, without the passkey ever needing to live on that computer.

What's the difference between a passkey and a password?

Microsoft's own comparison sums up the practical differences cleanly: "Unlike passwords, passkeys are easy to create, don't need to be remembered, and don't need to be safeguarded. Additionally, passkeys are unique to each website or application, preventing their reuse. They're highly secure because they're only stored on the user's devices, with the service only storing public keys," according to Microsoft Learn.

Breaking that down:

Reuse. A password can be typed into any site, which is why people reuse them — and why one breached site can compromise accounts elsewhere. A passkey is generated separately for each site and can't be reused anywhere else.
Theft from a server breach. If a company's servers are hacked, stored passwords (even hashed ones) can sometimes be cracked. Stored public keys are useless to an attacker on their own, because the private key needed to complete a login never left your device.
Phishing. A password can be typed into a fake page by a fooled human. A passkey simply won't function on a site it wasn't created for, because the browser and operating system check the site's identity first.
Memory burden. Passwords require you to remember them or store them somewhere. Passkeys require nothing to memorize — you just unlock your device.

One thing a passkey is not: your fingerprint or PIN. Those are user-verification steps that unlock the private key already sitting on your device — they're not the credential itself, and they're not sent anywhere.

How do I set up my first passkey?

The most accessible starting point for most people is an iPhone or iPad, where Apple builds passkey storage directly into the Passwords app. According to Apple's own support documentation, the Passwords app stores passkeys and keeps them synchronized and encrypted across your Apple devices through iCloud Keychain. In general terms:

Make sure iCloud Keychain is turned on so your passkeys will sync and back up across your Apple devices.
Go to a website or app that offers passkey login (many major services, including Google and Microsoft accounts, now support it).
When prompted to create a passkey, confirm with Face ID or Touch ID. Your device generates the key pair at this moment — the private key stays on your device, and only the public key is sent to the service.
The new passkey appears in the Passwords app, where you can view which sites it's saved for.
The next time you sign in on that site, your device will offer the passkey automatically; a Face ID, Touch ID, or passcode confirmation completes the sign-in — no typing required.

Android and Chrome users follow a similar pattern through Google Password Manager, and Windows users can do the same through Windows Hello, per Microsoft's passkey documentation.

What happens if I lose my device?

This is the part worth taking seriously before you need it. If a passkey is synced — say, through iCloud Keychain or Google Password Manager — losing one device isn't the end of the world, because the credential still exists on your other linked devices. Microsoft's enterprise documentation confirms this for its own system: "For synced passkeys, the credential is available on the customer's other linked devices. The customer can also sign in with email + password or username + password and a fallback MFA method. Admins can delete the lost passkey via the admin center or Graph API," according to Microsoft Entra's documentation.

Google specifically warns about one gap worth knowing: passkeys saved only to Windows Hello, rather than to Google Password Manager, don't have a safety net. "If you save passkeys to Windows Hello, you can't recover them if your computer is lost or the operating system is reinstalled," per Google's Chrome Help page.

Either way, set up your account recovery options — recovery contacts, trusted phone numbers, backup sign-in methods — before you lose a device, and keep those details somewhere safe and separate from the device itself.