A passkey replaces your password with a pair of cryptographic keys. When you create one, your phone, laptop or security key generates a private key that never leaves the device and a matching public key that the website stores. To sign in, the site sends a challenge, your device signs it after you approve with Face ID, a fingerprint or the device PIN, and the site verifies that signature against the public key it already holds. No shared secret travels over the network, there is nothing for a database breach to leak, and nothing for you to remember. They are built on the WebAuthn and FIDO2 standards and are already supported by Apple, Google and Microsoft.
How a passkey actually works
Passwords are a shared secret: you know it, the service stores a hash of it, and anyone who obtains it can be you. Passkeys break that symmetry. The private half is generated inside your device's secure hardware — the Secure Enclave on Apple devices, the TEE on Android, the TPM on Windows — and is never readable.
The public half is not a secret at all. If a service is breached and its passkey database dumped, the attacker gets a pile of public keys that are useless without the matching private ones — unlike a leaked password, which is immediately reusable everywhere you recycled it.
Your biometric data is part of the local unlock step only: the scan authorises your device to use the key and is never sent to the website.
What signing in feels like in practice
Better than you would expect. You tap the sign-in field, your device offers the saved passkey for that site, you confirm with a glance or a fingertip, and you are in. No typing, no password manager to unlock first, no code to copy out of a text message.
If the passkey lives on another device — signing into a desktop with a passkey stored on your phone, say — the site shows a QR code. You scan it, the two devices confirm over Bluetooth that they are near each other, and you are through. That proximity check stops an attacker relaying the code to a victim on the other side of the world.
Why passkeys resist phishing
Every passkey is cryptographically bound to the origin it was created for. A passkey for example.com will only ever sign challenges from example.com. Land on a convincing clone at examp1e.com and your browser simply does not offer the passkey — not because you spotted the misspelling, but because the domain does not match. The judgement call is taken away from the tired human at the keyboard.
That also defeats attacks that beat ordinary two-factor authentication. A proxy phishing kit can relay a password and a one-time code to the genuine site inside the code's validity window. It cannot do that with a passkey, because the signature is tied to a domain the attacker does not control.
Where you can use passkeys today
Support has moved quickly. Apple, Google and Microsoft accounts all accept passkeys, as do Amazon, PayPal, eBay, GitHub, LinkedIn, WhatsApp and a growing number of banks and government portals. Every current browser implements WebAuthn.
Coverage is still uneven. Plenty of smaller services, older enterprise systems and a surprising number of banks offer nothing but a password with an SMS code bolted on, so you will run a mixed setup for years.
The trade-offs worth knowing about
- Losing a device. If a passkey exists only on a phone that ends up in a river, you need another way in. Platform keychains — iCloud Keychain, Google Password Manager, Windows Hello — sync passkeys across devices and restore them to a new one. Hardware keys do not sync, so register two.
- Syncing means trusting a platform. A synced passkey is only as safe as the account holding it — better than reused passwords, but risk concentrated in one place.
- Account recovery is the weak link. Unbreakable passkey sign-in means little if the helpdesk resets accounts after two security questions.
- Shared and managed devices. Passkeys assume a device you control; family logins and locked-down work laptops still need thought.
- Services that keep the password anyway. Many sites add a passkey without letting you delete the password, leaving the old credential as a target.
The honest verdict
Turn on passkeys wherever they are offered, starting with the accounts that can reset everything else: your email, your platform account, your password manager. Then keep the rest of your defences in place, because most accounts still will not support them.
For anything that remains password-only, use a long, unique passphrase rather than a clever-looking short string — length is what defeats cracking. Our free passphrase generator builds memorable multi-word passphrases in the browser, and the guide on how to create a strong passphrase explains why four random words beat P@ssw0rd!. Keep them in a password manager; nobody memorises ninety of them.
Then add a second factor wherever it is available. An authenticator app producing time-based one-time codes is far safer than SMS, which can be intercepted through SIM-swap fraud — our piece on what a TOTP code is covers the detail. That combination, plus a freshly generated passphrase for each new signup, will carry you until passkey support catches up; all of these sit among the free tools on 1mail.
Frequently asked questions
What happens if I lose the device holding my passkey?
If it syncs through iCloud Keychain, Google Password Manager or similar, you restore it by signing into that platform account on a new device. If it does not sync, you fall back to whatever recovery the service offers — which is why registering a second device or a backup security key is worth five minutes.
Are passkeys the same as two-factor authentication?
Not quite. A passkey combines two factors in one step: something you have (the device holding the private key) and something you are or know (the biometric or PIN that unlocks it). Most services treat it as sufficient on its own.
Can I use passkeys without giving a website my fingerprint?
Yes. The biometric check happens on your device and only unlocks the local key; the website receives a signature and nothing else. If you would rather not use biometrics, a device PIN works the same way.
