Passkeys Explained: Are They Really Better Than Passwords?

Last updated: October 8, 2026

Diagram comparing how passwords and passkeys work during sign-in

You may have noticed sign-in pages offering to "create a passkey" and wondered whether it is a gimmick. It is not. Passkeys are a serious attempt to replace passwords with something that cannot be guessed, reused or typed into a fake website. Big platforms such as Google, Apple and Microsoft, along with many other services, now support them.

This guide explains what a passkey is, why security agencies and experts favor it, where it falls short, how it compares with passwords and two-factor codes, and how to set up passkeys on your Google, Apple and Microsoft accounts without locking yourself out.

What Is a Passkey?

A passkey is a login credential based on public-key cryptography. When you create one for a website or app, your device generates a pair of linked keys:

A public key, which is stored by the website. It is not secret, so a breach of the website does not reveal anything that lets an attacker sign in as you.
A private key, which stays with you, in your phone, computer or password manager. It never gets sent to the website. As Apple puts it, the server never learns what the private key is.

When you sign in, the website sends a challenge. Your device signs it with the private key after you approve the request with a fingerprint, face scan, or device PIN. The website checks the signature with the public key. There is no password to type, guess or steal in transit.

Passkeys are built on standards developed by the FIDO Alliance and the World Wide Web Consortium (the WebAuthn standard), which is why they work across different companies' products.

Why Passkeys Are Considered Better

They resist phishing

A passkey is tied to the real website address that created it. If you land on a lookalike fake page, your device will not offer the passkey, because the address does not match. Passwords, in contrast, can be typed into any page that looks convincing. This is the biggest security improvement.

US government guidance backs this up. In its 2025 digital identity guidelines, NIST states that passwords are not phishing-resistant, and that codes you type in by hand, such as text message and authenticator app codes, are not phishing-resistant either, because a fake site can relay them. NIST names WebAuthn, the standard behind passkeys, as an example of phishing-resistant authentication. CISA's fact sheet on phishing-resistant MFA goes further: "The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication."

They cannot be reused

Each passkey is unique to one service. Credential-stuffing attacks, where stolen passwords from one site are tried on others, do not work against them.

Website breaches matter less

Because the site stores only a public key, stealing its database does not give attackers usable logins for your account.

They are quicker

Approving with a fingerprint or face scan usually takes a second, with no codes to copy and no password to remember. Microsoft reported in May 2025 that people signing in with passkeys succeeded about 98% of the time, compared with about 32% for password users, and that passkey sign-ins were eight times faster than a password plus multifactor authentication (Microsoft Security Blog). These are Microsoft's own figures for its accounts.

Your biometrics stay local

The fingerprint or face data is used to unlock the key on your device. It is not sent to the website. Google states that biometric data used for fingerprint or face unlock stays on your device and is never shared with Google.

Where Passkeys Fall Short

They are not perfect, and it is worth understanding the limits.

Uneven support. Many sites still do not offer passkeys, and some offer them only as an extra option next to a password. You will live in a mixed world for years.
Recovery depends on the ecosystem. Passkeys synced through iCloud Keychain, Google Password Manager or Microsoft are protected by that account. If that account is compromised or lost, its passkeys are at risk. Losing access to it can hurt.
Device loss. If a passkey exists only on one device and that device is lost, you need the account recovery process on each site.
Anyone who can unlock your device can use it. Google warns that once you create a passkey, anyone who can unlock that device can access your Google Account, even if you sign out. Only create passkeys on devices you personally own and use.
Cross-platform friction. Moving from one ecosystem to another, such as from an iPhone to an Android phone, is improving but can still be awkward. Some password managers support storing passkeys to help with this.
Account recovery can be the weak link. If a site lets you recover an account with just an email or SMS code, an attacker may aim at that route rather than the passkey.
Shared or public computers. You may need to use a phone to sign in on a device that does not hold your passkey, which takes practice.

Passkeys vs Passwords vs Two-Factor Authentication

A password plus an authenticator code proves two things: something you know and something you have. A passkey typically combines something you have (the device holding the key) with something you are or know (your biometric or device PIN) in one step, so it often counts as strong multi-factor sign-in by itself. Many services treat a passkey as complete and will not ask for an extra code. Google, for example, says that if your account has 2-Step Verification, signing in with a passkey bypasses the second step, because the passkey verifies that you own the device.

Sign-in method	Phishing-resistant?	Can be reused across sites?	What a breached website leaks	What you need
Password only	No	Yes, if you reuse it	Password data that attackers can try to crack	Your memory or a password manager
Password + text message code	No; codes can be relayed by a fake site	Password can be	Password data	Password plus your phone number
Password + authenticator app code	No; codes can be relayed by a fake site	Password can be	Password data	Password plus the app
Synced passkey (phone, computer or password manager)	Yes	No; one per site	Only a public key	An unlocked device and your face, fingerprint or PIN
Passkey on a hardware security key	Yes	No; one per site	Only a public key	The physical key, usually plus a PIN or touch

NIST's 2025 guidelines treat synced passkeys as acceptable for strong multi-factor sign-in (its middle assurance level, AAL2), but require keys that cannot be copied off the device, such as hardware security keys, for its highest level (AAL3). For most people's personal accounts, a synced passkey is a large step up from a password.

That does not make passwords and 2FA obsolete today. If a site does not support passkeys, a strong unique password stored in a password manager plus an authenticator app or security key remains a good defense. Our guide to two-factor authentication options compares them.

How to Start Using Passkeys

Secure your device first. Set a strong lock-screen PIN or passcode and enable biometrics. The passkey is only as protected as the device unlock. Google notes that a passkey won't work on a device until its screen lock is turned on.
Secure the account that syncs your passkeys. Turn on strong two-factor authentication for your Apple, Google or Microsoft account, or for the password manager you use.
Start with the accounts that matter. Look in the security settings of your Google account, Microsoft account, and other services you use for "Passkeys" or "Sign in with a passkey". The account-specific steps are below.
Follow the prompts to create the passkey. Your device will ask you to verify with a fingerprint, face or PIN, and may ask where to save it (this device, a password manager, or a security key).
Keep another way in. Do not delete your password or other sign-in methods yet. Make sure you have recovery codes or a second passkey on another device. Google confirms that adding a passkey doesn't change or remove the other sign-in and recovery methods on your account.
Test signing in from a private browser window before relying on it. Note that Google says some browsers may not let you create or use passkeys in Incognito mode.
Add passkeys on a second device or a security key for the most important accounts to reduce lockout risk.

Setting Up Passkeys on Google, Apple and Microsoft Accounts

Google Account

Create: go to myaccount.google.com/signinoptions/passkeys and choose Create a passkey. To put one on a hardware security key, choose Use another device. Repeat on each device you want to use.
Requirements: Google lists Windows 10, macOS Ventura, ChromeOS 109, Android 9 or iOS 16 and later, with a current browser such as Chrome, Safari, Edge or Firefox. On Apple devices, iCloud Keychain must be on.
Timing: Google says you may need to wait 7 days before a newly created passkey is available at sign-in, although an existing trusted passkey or security key may speed this up.
Lost device: from another device, open your Google Account, go to Security & sign-in, then Passkeys and security keys, and remove the passkey. Our guide to recovering a hacked Google account covers what else to check.

Apple Account and iCloud Keychain

On iPhone, iPad and Mac, passkeys are saved in iCloud Keychain and sync across your Apple devices. Apple says iCloud Keychain is end-to-end encrypted with keys not known to Apple.
Apple requires two-factor authentication on any Apple Account that uses iCloud Keychain, and prompts you to set it up if you try to save a passkey without it.
Apple designed passkeys to be recoverable even if you lose all your devices, through iCloud Keychain recovery. Apple also suggests setting up an account recovery contact so you can regain access if you forget your Apple Account password or device passcode.

Microsoft Account

Create: Microsoft's instructions are to sign in to Advanced Security Options at account.live.com/proofs/manage, choose Add a new way to sign in or verify, then select Face, Fingerprint, PIN, or Security Key and follow the prompts on your device.
Where it's saved: you can save the passkey to Microsoft Password Manager or another synced credential manager (such as Google Password Manager or iCloud Keychain), to a phone or tablet, to a physical security key, or to the Windows device itself using Windows Hello.
Passwordless accounts: Microsoft announced in May 2025 that brand-new Microsoft accounts are "passwordless by default," and that existing users can delete their password from their account settings. Only do that once you have more than one working way to sign in.

Where Are My Passkeys Stored?

Options include:

Your phone or computer's built-in store, such as Apple's Passwords/iCloud Keychain, Google Password Manager or Windows Hello. These are convenient and sync across your devices in the same ecosystem.
A password manager that supports passkeys. Bitwarden, 1Password and Proton Pass all say they can save passkeys, and Bitwarden and Proton Pass list passkeys on their free plans. Support can vary by browser, operating system and app version, so check the manager's help pages before you commit.
A hardware security key that holds passkeys on the physical device. This keeps the private key off your phone or cloud accounts, but capacity and support differ between key models.

Consider using one main location rather than scattering passkeys across several places, so you always know where to look. If you remove a passkey from your Google Account but are still prompted to use it, Google suggests checking whether it is also stored in a third-party credential manager.

Frequently Asked Questions

Can someone steal my passkey by phishing me?

It is far harder than stealing a password, because the passkey will not work on a fake address. Scammers can still trick you in other ways, such as convincing you to approve an unexpected sign-in prompt or to give up access to your synced account. Our guide to the signs of a phishing email covers those tricks.

What if I lose my phone?

If your passkeys sync through your Apple, Google or Microsoft account, sign into that account on a new device and they can return. Remove the lost device's passkey from your account, and review signed-in devices using our guide to checking which devices have access to your account. Otherwise use each site's account recovery. This is why recovery codes and second devices matter.

Do I still need a password manager?

Yes, for now. Most of your accounts still use passwords, and some managers also store passkeys.

Are passkeys the same as biometrics?

No. Biometrics or a PIN unlock the passkey on your device. The passkey itself is a cryptographic key.

Does a passkey replace two-step verification?

Often, yes. Google says a passkey sign-in bypasses the second step of 2-Step Verification because it already proves you have the device. You can still keep 2-Step Verification on for sign-ins that use your password.

Are passkeys safe to use on shared computers?

Prefer using your phone to approve the sign-in, and avoid saving passkeys to a device you do not control. Google advises against creating a passkey on a shared device.

If my email shows up in a breach, does a passkey protect me?

A passkey can't be leaked from a website the way a password can, because the site only holds a public key. You should still change any password on that account. See our guide on what to do after a data breach.

Related Guides

Conclusion

Passkeys are better than passwords in the ways that count most: they resist phishing, cannot be reused and make website breaches far less damaging, which is why NIST and CISA single out the standard behind them. They are not a complete solution yet, because support is uneven and recovery depends on your ecosystem. Start by adding them to your Google, Apple or Microsoft account, keep a fallback sign-in method, and protect the device and account that hold them. Over time, you will type fewer passwords and be exposed to fewer scams.

Search This Blog

Safe Sign In