🔑 What Are Passkeys? A Plain-English Guide to Setting Them Up (2026)
On this page
A passkey is a replacement for your password that uses a pair of cryptographic keys instead of a secret you type. A private key stays locked on your device and a matching public key sits on the website, so there is no password to guess, phish, or steal in a breach.
For thirty years the password has been the front door to our digital lives, and for most of that time it has been the weakest point too. Passkeys are the technology built to retire it — and unlike the many "password killers" that came before, this one has Apple, Google, and Microsoft shipping it to billions of devices right now. If you have unlocked your phone with your face or fingerprint, you already understand how a passkey feels. This guide explains what a passkey actually is, why it is dramatically harder to attack than any password, and exactly how to set one up on the accounts you use every day.
What Exactly Is a Passkey?
A passkey is built on an open standard called FIDO2/WebAuthn, developed by the FIDO Alliance and the World Wide Web Consortium. When you create a passkey for a website, your device generates two mathematically linked keys. The private key is stored in the secure hardware of your phone or computer and never leaves it. The public key is handed to the website. When you sign in, the site sends a challenge, your device signs it with the private key after you approve with your biometric or PIN, and the site verifies the signature with the public key it already holds.
The crucial difference from a password is that nothing secret is ever transmitted or stored on the company's servers. A password is a shared secret: you know it, the website stores a version of it, and anyone who intercepts or breaches that copy can impersonate you. A passkey shares only the public key, which is useless to an attacker on its own. The FIDO Alliance, the industry body behind the standard, describes passkeys as inherently "phishing-resistant" precisely because the private key is cryptographically bound to the exact website it was created for and simply will not respond to a lookalike domain.
Why Passkeys Beat Passwords
Passwords fail in predictable ways: people reuse them, choose weak ones, and get tricked into typing them on fake login pages. Passkeys remove all three failure modes at once. There is nothing to reuse, nothing weak to choose, and nothing a phishing site can capture. This matters because credential theft remains the number-one breach vector. The Verizon Data Breach Investigations Report has for years found stolen and reused credentials among the leading causes of breaches, ahead of any software flaw — and passkeys eliminate the shared secret those attacks depend on.
They are also faster. When Google made passkeys the default for personal accounts, it reported that signing in with a passkey is roughly twice as fast as a password and far less error-prone. And the approach now has formal backing from standards bodies: NIST, the U.S. authority on digital identity, updated its guidelines to recognise "syncable authenticators" — the technical name for passkeys — as an accepted phishing-resistant method for securing accounts.
| Property | Password | Passkey |
|---|---|---|
| Can be phished | Yes — typed into fake sites | No — bound to the real domain |
| Exposed in a data breach | Yes — servers store a copy | No — only a useless public key is stored |
| Can be reused across sites | Yes — the core risk | No — unique per website |
| Something to remember | Yes | No — unlocked by biometric or PIN |
| Works offline against guessing | Vulnerable to cracking | Immune — no secret to crack |
How to Set Up a Passkey: Step by Step
Creating a passkey takes under a minute and the flow is almost identical everywhere. Here is the general process, which you can follow on any account that supports it.
- Open the account's security settings. Look for a section named "Passkeys," "Sign-in options," or "Security." Google, Apple, Microsoft, Amazon, PayPal, and GitHub all offer this today.
- Choose "Create a passkey" or "Add a passkey." The site will ask your device to generate the key pair.
- Approve with your biometric or PIN. Use Face ID, Touch ID, Windows Hello, or your screen-lock PIN. This proves it is you and unlocks the private key locally.
- Choose where to store it. You can save it to your device's built-in keychain, or to a dedicated password manager so it syncs across everything you own.
- Test it once. Sign out and sign back in with the passkey so you know the flow before you rely on it.
Where Passkeys Are Stored — and Why a Manager Helps
By default, a passkey lives in your platform's keychain: iCloud Keychain on Apple devices, Google Password Manager on Android and Chrome, or Windows Hello on a PC. That is convenient inside one ecosystem, but it gets awkward the moment you cross it — creating a passkey on your iPhone and then trying to use it on a Windows laptop, for example.
This is where a dedicated password manager earns its place. A cross-platform manager such as NordPass stores your passkeys in one encrypted vault that syncs across iOS, Android, Windows, macOS, and your browsers, so the same passkey works on every device regardless of brand. It uses zero-knowledge, XChaCha20 encryption, keeps your remaining passwords in the same place during the transition, and adds breach monitoring that flags any old login still exposed in a leak. Because passkeys and passwords will live side by side for years while websites catch up, having both managed together — and syncing everywhere — removes the biggest friction people hit when they first switch.
The Catch: Passkeys Are Not Everywhere Yet
Adoption is racing ahead but it is not universal. Some sites still offer no passkey option, and a few implementations only let you use a passkey as a second factor rather than a full password replacement. Device support has caught up on any reasonably modern phone or computer, but syncing a passkey created in one ecosystem to a device in another can still require a QR-code hand-off. None of this is a reason to wait: enable passkeys on your most important accounts now — email, banking, and your password manager itself — and add the rest as each service switches them on.
FAQs
Are passkeys safer than passwords and two-factor authentication?
Yes, for most people. A passkey is phishing-resistant by design because it will only work on the genuine website it was created for, which defeats the fake-login-page attacks that beat both passwords and SMS codes. It also combines two factors in one step — something you have, your device, and something you are, your biometric — so a single tap gives you protection that would otherwise need a password plus a separate app. It is one of the strongest everyday sign-in methods available.
What happens to my passkey if I lose my phone?
You do not lose access, provided your passkeys sync. Platform keychains like iCloud and Google, and password managers, back your passkeys up to your account and restore them to a new device once you sign in. This is exactly why storing passkeys in a synced manager is worth doing: the passkey is not trapped on one piece of hardware. Always keep at least one backup sign-in method on important accounts until you are confident your sync is working.
Do I still need a password manager if I use passkeys?
For the foreseeable future, yes. Most of your accounts will keep using passwords for years while the web transitions, so you still need somewhere to generate and store strong, unique passwords. A modern manager now holds both, letting you use passkeys where they are offered and strong passwords everywhere else, all in one encrypted vault that syncs across your devices.
Can someone steal my passkey?
Not in the ways passwords get stolen. The private key never leaves your device's secure hardware and is never sent to the website, so there is nothing to intercept in transit or breach from a server. An attacker would need physical possession of your unlocked device and the ability to pass your biometric or PIN, which is a far higher bar than guessing or phishing a password.
Which accounts should I set up passkeys on first?
Start with the accounts that unlock everything else: your primary email, because it can reset most other passwords; your online banking; and your password manager itself. Then add big targets like Google, Apple, Microsoft, Amazon, and PayPal, all of which support passkeys today. Work outward from there as more of the services you use enable the option.
