Security & Privacy
A calm, jargon-free guide to passkeys, explaining what they are, why they are safer than passwords, and how to set them up on your everyday devices.
Passkeys let you sign in to a website or app with the same Face ID, fingerprint, or device PIN you already use to unlock your phone, with no password to type, remember, or reset. Under the hood a passkey is a pair of cryptographic keys built on the FIDO2 and WebAuthn standards, and understanding that pair is what lets you use them confidently.
When you create a passkey, your device generates two mathematically linked keys, usually an ECDSA key pair on the P-256 curve. The private key is written into secure hardware on your device: Apple's Secure Enclave, an Android StrongBox or Trusted Platform Module (TPM), or the TPM chip that Windows Hello uses. It is designed never to leave. The public key is the only half that gets sent to the website (the "relying party"). A public key is useless to an attacker on its own, so a breach of that server leaks nothing worth stealing.
Signing in is a challenge-and-response exchange. The site sends your device a random challenge, your device signs it with the private key, and it returns the signature, which the site verifies against the stored public key. Your fingerprint or face is only the local gesture that unlocks the private key for that one signature. The biometric data itself never touches the network and never reaches the website. That distinction trips a lot of people up: the site never sees your face, only a signed math problem.
There are two flavors. Synced passkeys are backed up to your platform account, whether iCloud Keychain, Google Password Manager, or a third-party manager like 1Password or Bitwarden, so they appear on every device signed into that account and survive a lost phone. Device-bound passkeys (common on physical security keys like a YubiKey, and in some workplace setups) never leave the single device. Synced is more convenient and far safer against lockout; device-bound is marginally more secure but unforgiving if the device dies.
Passwords fail in three predictable ways: people reuse them, attackers guess or brute-force them, and phishing pages trick people into typing them. Passkeys close all three doors at once.
Because every passkey is unique and generated by the device, there is no reused secret, so a leak on one site cannot cascade to your others. Because there is no shared secret stored server-side, a database breach exposes only public keys. And because a passkey is cryptographically bound to the exact domain it was made for (the "origin"), it physically cannot be used on a lookalike page. A passkey made for google.com will not fire on g00gle-login.com, no matter how convincing the copy, because the browser checks the origin before your key ever responds. This is why FIDO calls passkeys "phishing-resistant," and it is the single biggest practical upgrade over passwords and even over SMS one-time codes, which can still be phished.
Do not migrate everything at once. Add a passkey to one account you care about, then get a feel for it. Google, Apple, Microsoft, Amazon, PayPal, and GitHub all support them. The prompt usually lives in the account's Security or Sign-in settings under a button like "Create a passkey."
First confirm sync is on: Settings > [your name] > iCloud > Passwords (labeled "Passwords and Keychain" on older iOS). Then, on a supporting site, tap "Create a passkey" and approve with Face ID or Touch ID. Manage everything afterward in the dedicated Passwords app on iOS 18, or under Settings > Passwords on iOS 17.
Google Password Manager is the default provider. Check it under Settings > Google > All services > Passwords, passkeys & autofill > Google Password Manager. Creating a passkey on a site or app prompts a fingerprint or face check, and it syncs to any Android device or Chrome browser on the same Google account. Android 14 and later also let third-party managers act as the passkey provider.
Windows Hello stores passkeys in the TPM; set it up under Settings > Accounts > Sign-in options. Windows 11 (version 23H2 and later) lists your saved passkeys under Settings > Accounts > Passkeys, and version 24H2 added support for third-party providers like 1Password. In Chrome, visiting chrome://settings/passkeys shows what is stored locally.
A few habits are worth forming:
On a device that holds your passkey, signing in is a single tap. Most sites surface it through autofill (called "conditional UI"), so your passkey appears right above the keyboard the moment you tap the username field.
The clever part is signing in somewhere that does not have your passkey, like a friend's laptop or a shared work PC. Choose "Sign in with a passkey from another device," and the screen shows a QR code. Scan it with your phone's camera, and the two devices then confirm they are physically near each other over Bluetooth Low Energy before anything is signed. That proximity check is deliberate: it stops an attacker from relaying the QR code to you from across the world. Your private key stays on your phone the whole time, and the laptop only receives a one-time signed response.
Trusting a single device with no sync. If you create a device-bound passkey and the phone is lost or wiped, that login can be gone for good. Confirm that iCloud Keychain or Google Password Manager sync is on before you rely on a passkey.
Deleting your password too early. Until every device and browser you use handles the passkey smoothly, keep the password as a backstop. Removing it prematurely is the fastest route to a lockout.
Assuming ecosystem passkeys roam freely. A passkey synced through iCloud Keychain does not automatically appear on Windows or Android. If you live across ecosystems, use a cross-platform manager like 1Password, Bitwarden, or Dashlane so your passkeys follow you, not one operating system.
Ignoring recovery. Passkeys secure the front door, but account recovery is still the weak link. Keep printed backup codes and a current recovery email or phone number, because "I lost all my devices" is the one scenario passkeys alone do not solve.
Thinking biometrics are shared. Your face and fingerprint never leave the Secure Enclave or TPM. Anyone claiming a site "has your fingerprint now" has misunderstood how the handshake works.
Yes, as long as your passkeys were synced. Sign into iCloud Keychain, Google Password Manager, or your third-party manager on a new device and they reappear. If you used a device-bound passkey with no sync, you will need your backup password or the site's account-recovery process instead.
Not automatically, because Apple and Microsoft keep passkeys in separate vaults. You can create a second passkey on the laptop, use the phone-and-QR-code cross-device flow, or store passkeys in a cross-platform manager like 1Password so both devices share one set.
Yes. SMS codes can be phished on a fake page or intercepted through SIM-swapping, but a passkey is bound to the real domain and never transmits a reusable secret, so a spoofed site gets nothing. It removes the two weakest links, the typed password and the shared code, in a single step.
Support is growing fast. Google, Apple, Microsoft, Amazon, PayPal, GitHub, eBay, Adobe, TikTok, WhatsApp, and Nintendo already offer them, among many others. The community-maintained site passkeys.directory keeps a current list if you want to check a specific service.
Theo writes about online safety the way a good friend would — clearly, calmly, and without trying to scare you. He's interested in the simple habits that stop most problems, and he thinks staying private online is a skill anyone can learn.
Keep reading
A reassuring, jargon-free guide to spotting fake online stores, covering the warning signs in prices, contact details, payment options, and reviews.
Theo Vance
A calm, jargon-free guide to protecting your privacy on your phone, covering app permissions, location sharing, lock screens, and trimming back data tracking.
Theo Vance