What Is a Passkey?
Author: Domeny.ForSale editorial team Published
In brief: A passkey is a way to sign in to an account without entering a password. You usually approve the sign-in with a fingerprint, facial recognition or your device’s PIN. A passkey is tied to a specific service, making it much better than a traditional password at protecting against attempts to steal your login details on a fake website.
How does a passkey work, and how is it different from a password?
Creating a passkey generates a pair of cryptographic keys, meaning mathematically related data: a public key and a private key. The service stores the public key, while the private key remains under the control of your device or the provider that stores and synchronises your passkeys. The private part is not sent to the service when you sign in.
When you want to access your account, the service sends a one-time challenge. After you approve it, your device signs it with the private key, and the service checks the signature using the public key. You do not need to remember or type out any secret.
Your fingerprint, face scan and PIN are not the passkey itself. They are used to confirm locally that you are allowed to use the key. In a typical passkey sign-in, the service does not receive your fingerprint or an image of your face. Your device’s PIN does not become the website’s password either.
A passkey is not simply a password saved in your browser. A password manager can fill in a username and password form, whereas a passkey uses a different authentication mechanism. The same manager can, however, support both methods.
What does a passkey protect against?
The main advantage of a passkey is its resistance to typical phishing: impersonating a service to steal login details. The key is tied to a service identifier based on its domain. A fake website at a different address cannot simply ask the browser to use the key belonging to the genuine service.
For example, you receive a message claiming that your account with an online shop has been blocked. The link leads to a website that looks deceptively similar to the original but uses an unrelated domain. You might accidentally enter a regular password there; the correct passkey will not work on that fake website.
A leak of public keys from a service does not directly allow anyone to reconstruct the corresponding private keys or sign in using the public key alone. It also removes the problem of reusing one password across several services.
This does not mean protection against every attack. Malware, a hijacked active session or a weak account recovery procedure can still pose a threat. If the service retains password sign-in or recovery by email, the security of those routes still matters.
Where is a passkey stored?
The storage method affects whether you can also sign in on another device. Not every passkey is automatically available everywhere.
- Synchronised passkeys are shared across compatible devices by a provider, such as a built-in or third-party credential manager. Access to them depends on the provider account and its recovery policies.
- Device-bound passkeys remain on a specific device, such as a hardware security key. They are not automatically copied to other devices.
A phone can also approve a sign-in on a computer that does not store your passkey. In a supported scenario, the computer displays a QR code, which you scan with your phone before confirming the sign-in. An internet connection and Bluetooth are usually required to confirm that the devices are nearby; this does not mean the key is permanently copied to the computer.
Support depends on the service, operating system, browser and credential manager. Before changing your phone or moving to another ecosystem, check the provider’s official documentation for the current options for synchronising and transferring keys.
How do you enable a passkey on your account?
You cannot enable a passkey yourself for just any website—the service must support it. The relevant option is usually in the account’s security settings under “Passkeys”.
- Sign in to the service using your existing method and open the security settings.
- Choose to add a passkey. Check where it will be saved: in a credential manager or on a hardware key.
- Approve the creation of the key using the method indicated by your device.
- Test the new sign-in method while keeping an active session or another access method available.
- If the service allows it, add a second key on an independent device or prepare recovery codes.
Use your own secured device for this. Do not save a personal passkey in a browser profile on a public or shared computer.
What should you do if you lose your phone?
Losing your phone does not necessarily mean losing your account. A synchronised passkey may be available on another compatible device, and an additional hardware key can provide an independent way to sign in. If your only key was bound to the lost device, you may need to use the recovery procedure offered by the service.
After losing a device, use its remote locking feature and check your accounts’ active sessions. Once you regain access, remove the lost credentials where necessary, following the provider’s instructions.
Before disabling your password, carry out one practical test: check whether you can sign in without your main phone. This will show whether you have a genuine backup method rather than just assuming that synchronisation will be enough.
See also: What Is 2FA?
Read also
