What is a passkey?

A passkey is a way to sign in to websites and apps without a password. Instead of typing something, you do what you already do to unlock your phone or computer: use your fingerprint, your face, or a PIN. Behind the scenes, a pair of keys proves it’s you. A private key stays on your side, and a matching public key is stored by the website.

If you run a small business, you probably juggle a lot of accounts: email, accounting, a booking system, the platform that hosts your online course. Passkeys cut down on passwords to remember and make account takeover much harder. Knowing how they work helps you decide calmly the next time a service asks, “Create a passkey?”

How does a passkey work?

Passkeys use public-key cryptography, a kind of encryption that works with a matched pair of keys. They are built on standards from the FIDO Alliance, an industry group that promotes sign-in without passwords, and the W3C, which sets web standards. The part that lets browsers use passkeys is the W3C Web Authentication (WebAuthn) specification.

What does each key do?

Think of the private key as a personal stamp that only you hold, and the public key as a sample impression the site keeps on file to compare against. Unlike a real stamp, though, the public key cannot practically be used to work out the private key. The math is designed that way.

Key	Where it lives	What it does
Private key	On your device, or in your password manager	Creates a “signature” each time you sign in
Public key	On the website’s server	Checks that the signature is genuine

Because the site only holds your public key, a leak of the site’s data does not hand anyone a way to sign in as you. Each site also gets its own separate key pair.

What happens when you sign in?

1. When you create a passkey, your device makes a new key pair just for that site and sends only the public key to the site.
2. When you sign in, the site sends a random value, called a challenge, that is different every time.
3. Your device checks that its owner is the one using it, with your fingerprint, face, or PIN.
4. Once that check passes, your device signs the challenge with the private key and sends the signature back.
5. The site verifies the signature with the public key it stored. If it matches, you are signed in.

The private key itself is never sent to the site when you sign in. And since every sign-in uses a new challenge, someone who copies a signature in transit cannot reuse it next time.

Why are passkeys hard to phish?

Phishing is when someone lures you to a fake copy of a real site to get you to type your password or a code. For example, students of an online course might receive an email about “updating your payment details” that links to example-schooI.com (with a capital I) instead of example-school.com. The two can look almost identical.

A passkey is tied to the domain of the site where you created it. A domain is a site’s address on the web, like example-school.com. When you sign in, your browser or app checks the domain of the page you are on and only uses passkeys made for that domain. A fake domain has no matching passkey, so nothing is offered at all. You don’t have to spot the difference yourself, and that is the big change from passwords.

	Password	Passkey
Memorizing	Required	Not needed. You just unlock your device
Reuse across sites	Common	A separate key is made for each site
If the site leaks data	The leaked password can be used to sign in	Only the public key leaks, and it cannot sign you in
On a fake site	You may type it in without noticing	Not used on a different domain

One caveat: if your account still has other ways to sign in, such as a password or an email code, a fake site may try to get you to enter those instead. Even with passkeys, it’s a good habit not to sign in through links in emails you weren’t expecting.

How do passkeys work across devices?

Some passkeys sync between your devices, and some never leave a single piece of hardware. The FIDO Alliance calls both kinds passkeys.

Synced passkeys

Passkeys you create on a phone or computer are often saved by a password manager and synced to the other devices signed in to the same account. On Apple devices they go into iCloud Keychain, and on Android and Chrome into Google Password Manager. You can also save them in a third-party password manager that supports passkeys. Apple says passkeys in iCloud Keychain are end-to-end encrypted, meaning only your own devices can read them.

Device-bound passkeys

A passkey stored on a security key, a small device you plug in over USB or tap over NFC (short-range wireless), never leaves that key. That makes it very hard to copy, but if you lose the key, that passkey is gone. Device-bound passkeys are common where a higher level of assurance is needed, such as some workplaces.

	Synced passkey	Device-bound passkey
Where it lives	A password manager (the cloud and your devices)	One device or security key
When you get a new phone	Sign in to the same account and it’s there	Create a new one on the new device
If you lose a device	Still on your other devices, or restored through account recovery	You need another way to sign in

Signing in on a device that isn’t yours

You can often sign in on a computer that doesn’t have your passkey, such as a friend’s laptop. On the sign-in screen, choose “Other options,” “Passkey from nearby device,” or something similar, and a QR code appears. Scan it with the phone that holds your passkey, then confirm with your fingerprint or face on the phone. The two devices use Bluetooth to check that they are near each other, so keep Bluetooth turned on.

What happens if you lose your device?

First, whoever finds your device can’t simply use your passkeys. They would need the fingerprint, face, or PIN that unlocks it. Beyond that, it depends on the kind of passkey.

• Synced passkeys: if you still have another device with the same passkeys, keep using it. Even if you lose every device, you can get them back on a new device by signing in to your Apple, Google, or other account and passing its recovery checks, such as entering an old device’s passcode.
• Device-bound passkeys: without that device or key, the passkey can’t be used. You’ll sign in with a backup security key or another sign-in method.

When you notice a device is missing, work through these steps:

1. For synced passkeys, remove the lost device from your Apple, Google, or other account by following that provider’s instructions.
2. For device-bound passkeys, delete that device’s passkey in each site’s account settings. Once the site deletes the public key, the matching private key can no longer sign you in.
3. Create the passkeys you need again on your new device or security key.

What should you keep in mind when you start?

• Don’t create passkeys on a device you share with family or coworkers. Anyone who can unlock that device can sign in with them.
• Set a screen lock (fingerprint, face, or PIN) on your devices. Passkeys are only as safe as the lock that protects them.
• Keep a second way into each important account, such as another sign-in method or a second passkey. It is your way back in if you lose a device.
• You can view and delete your passkeys in your device’s password manager, for example the Passwords app on an iPhone.

Summary

A passkey replaces a password with a pair of keys: a private key on your device and a public key on the website. There is nothing to type and the key is tied to the site’s domain, so passkeys are much harder to phish. Synced passkeys follow you to a new phone. Set a screen lock and keep a second way to sign in, and losing a device becomes manageable. To see how passkeys relate to the second check at sign-in, read “What is two-factor authentication (2FA)?”