What Is a Passkey and How Does It Work?

A passkey is a sign-in credential that replaces your password with a pair of cryptographic keys: a private key that never leaves your device, and a public key that the website or app stores on its server. To sign in, your device proves it holds the private key — usually by unlocking with your fingerprint, face, or screen-lock PIN — and the site checks that proof against the public key it already has. Nothing you type or memorize ever crosses the internet, which is why passkeys can't be phished, guessed, or reused from a leaked database the way passwords can.

How passkeys work: public-key cryptography in plain English

Every passkey relies on a technique called asymmetric, or public-key, cryptography. Instead of one shared secret that both you and a website know (a password), your device generates two mathematically linked keys: a private key and a public key. The private key is kept secret on your device — inside a secure hardware enclave on a phone or laptop, or on a physical security key — and is never transmitted anywhere, not even to the website you're signing into. The public key, as its name suggests, can be shared freely, because it's only useful for checking signatures created by its matching private key; it can't be used to impersonate you.

When you create a passkey for an account, your device generates this key pair specifically for that account on that specific website. The public key is sent to the site and stored next to your account record. The private key stays put. From that point on, signing in doesn't involve sending a password at all — it involves a cryptographic back-and-forth called challenge-response.

How a passkey is created and used: challenge-response in practice

Setting up and using a passkey generally follows the same two-step pattern everywhere, whether it's a phone, laptop, or hardware security key handling the cryptography:

• Registration (creating the passkey): The website's server generates a random challenge and asks your device to create a credential for your account. Your device creates the public/private key pair, signs the challenge with the new private key to prove the pair was just generated under your control, and sends the public key plus that signature back to the site. The site stores the public key and discards nothing sensitive, because nothing sensitive was ever sent.
• Authentication (signing in): The next time you visit, the site sends a fresh, random challenge. Your device's platform authenticator — the built-in software that manages passkeys on your phone, tablet, or computer — asks you to unlock it with a fingerprint, face scan, or PIN. That unlock doesn't go to the website; it simply authorizes your device to use the stored private key to sign the new challenge. The signed response goes to the site, which verifies it against the public key on file. If the signature checks out mathematically, you're in.

Because a fresh, random challenge is used every single time, a captured sign-in response is useless for a replay attack — it was only ever valid for that one challenge. And because biometric data used to unlock the device is checked locally and never sent to the website, a data breach at the website can't expose your fingerprint or face scan, only a public key that's useless without its private half.

Why a passkey can't be used on a fake site

Phishing resistance is, in FIDO Alliance's own words, "a core design goal" of the standard passkeys are built on. The mechanism that makes this work is simple but effective: when your browser or operating system creates or uses a passkey, it cryptographically binds that passkey to the exact website domain that requested it. If you created a passkey for accounts.google.com, your device will not offer that passkey to a convincing look-alike site at accounts-google-security.com, even if the fake page is pixel-perfect — the domain check happens at the platform level, before any human judgment is involved.

That's a structural difference from passwords and even from one-time codes sent by SMS or generated by an authenticator app, both of which a user can be tricked into typing into a fake site. A passkey simply isn't presented as an option on a domain it wasn't created for, so there's no credential for a victim to hand over even under pressure or deception. It's also why passkeys defend against increasingly convincing social-engineering tactics — including AI-powered voice and video deepfake scams that try to rush a target into bypassing normal safeguards: there's no code or password for an attacker to talk someone into revealing in the first place.

Synced passkeys vs. device-bound passkeys

Not all passkeys behave identically once they're created, and the distinction matters for both convenience and recovery:

• Synced passkeys are backed up to an end-to-end encrypted cloud credential manager — Apple's iCloud Keychain, Google Password Manager, or Microsoft Password Manager are the three major examples. Once synced, the same passkey becomes available automatically on your other devices signed into that same account, and it survives losing or replacing a single device.
• Device-bound passkeys are generated on, and never leave, one specific piece of hardware — most commonly a physical FIDO2 security key, but also certain enterprise-managed devices. FIDO Alliance describes device-bound passkeys on modern security key hardware as offering the highest level of security assurance, because the private key genuinely cannot be extracted or copied anywhere, even by the device's own operating system. The trade-off is recovery: if that one device is lost, destroyed, or stolen, the passkey goes with it, and you'll need a backup sign-in method or a second registered key.

Most people encounter synced passkeys by default, since Apple, Google, and Microsoft all route new passkeys into their respective cloud keychains unless you specifically choose a security key instead.

Setting up and using passkeys on Google, Apple, and Microsoft accounts

Google Account: Go to your account's passkey settings page and tap "Create a passkey," then confirm again and unlock your device. Google notes a newly created passkey can take up to seven days to show up at sign-in everywhere, and that on Android you can still sign back in with a passkey for up to six hours after signing out before another method is required. To sign in on a computer using a passkey saved on your phone, choose "Use your passkey," scan the QR code that appears with your phone, and confirm on the phone itself — Bluetooth needs to be on for that proximity check to succeed.

Apple Account (iCloud Keychain): On a supported Apple device, choosing to create a passkey for an app or website triggers a Face ID or Touch ID prompt, and the new passkey is then synced across your other Apple devices through iCloud Keychain, which Apple end-to-end encrypts using keys Apple itself doesn't have access to. Apple requires two-factor authentication on the Apple Account before iCloud Keychain will sync passkeys at all. Signing in on a brand-new Apple device for the first time requires your Apple Account password plus a six-digit verification code, after which that device joins the keychain and can use your synced passkeys going forward.

Microsoft Account: Open Advanced Security Options for your Microsoft account, choose "Add a new way to sign in or verify," then "Face, Fingerprint, PIN, or Security Key," and follow your device's prompts. Microsoft lets you choose where the new passkey is stored: Microsoft Password Manager (which syncs across your Windows devices), a phone or tablet via QR code scan, a physical security key, or directly on a Windows PC through Windows Hello. Once a passkey exists, Microsoft's sign-in page detects it automatically and prompts for your device's unlock method instead of a password.

Passkey vs. password vs. authenticator app (2FA)

It's easy to lump passkeys in with other login upgrades, but they solve a different problem than either a stronger password or an added one-time code. A password is a shared secret you type; a traditional authenticator app or SMS code is a second, separate secret you type in addition to a password; a passkey replaces the secret-typing step entirely with a cryptographic proof that can't be copied out of your device or guessed. Pandromeda has a dedicated guide to setting up and using device biometric unlock methods like Windows Hello and Face ID — those are the local "something you are" checks that unlock a passkey's private key on your device, not the credential standard itself. The comparison below focuses specifically on the sign-in credential, not the unlock gesture layered on top of it.

This is also where passkeys differ from a standalone authenticator app: an authenticator app generates a rotating code that is still a secret you can be tricked into typing into a fake page. A passkey never produces anything for you to type at all, which is the structural reason it closes a phishing gap that strong passwords and code-based two-factor authentication both leave open.

What happens if you lose your device

Recovery depends on whether your passkeys were synced or device-bound. If you use iCloud Keychain, Google Password Manager, or Microsoft Password Manager, your passkeys live on in the cloud keychain and become available again the moment you sign into a new device and verify your identity — Apple's recovery, for example, requires your Apple Account credentials, a code sent to your trusted phone number, and your device passcode, and locks the recovery record after ten failed attempts as a brute-force defense. If your passkey was device-bound to a single security key that's now lost, there's no copy to restore; you'll need to fall back to another registered sign-in method (a password, a second key, or a different passkey) and then register a replacement. That's the main reason official guidance from all three companies recommends keeping at least two sign-in methods active per account rather than relying on one single passkey.

What's next for passkeys

Passkey support keeps expanding past Google, Apple, and Microsoft accounts to individual banks, retailers, and workplace single sign-on systems, and FIDO Alliance continues to publish updated guidance as the CTAP and WebAuthn specifications evolve to cover new scenarios like cross-device hybrid sign-in. For most people, the practical next step is simple: create a passkey for the accounts that matter most — email, your device manufacturer account, and your password manager itself — using the steps above, while keeping a password or security key as a backup until every service you use has made the switch.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage