What Is a Passkey? A Plain-English Guide to Passkeys and How to Use Them

If a website has asked you to “create a passkey” and you were not sure what that meant, you are not alone. So, what is a passkey? A passkey is a way to sign in to an account without a password. Instead of typing something you have to remember, you unlock your phone or computer with your face, fingerprint, PIN or screen lock, and your device proves to the website that it is really you. This guide explains how passkeys work, where they are kept, how to add one to a Google or Microsoft account, and what happens if you lose your phone.

This is an independent guide. It is not affiliated with Google, Apple, Microsoft or any password manager; for account problems, use each company’s own support site.

How passkeys work, in plain English

Passkeys are built on an open standard from the FIDO Alliance, a group of technology companies that includes Apple, Google and Microsoft. That is why the same idea works across iPhones, Android phones, Windows PCs and Macs.

When you create a passkey, your device makes a matching pair of digital keys:

• A private key, which stays on your device (or in your passkey manager) and is never sent to the website.
• A public key, which the website stores. On its own it is useless to a thief.

When you sign in, the website sends your device a one-time challenge. Your device asks you to unlock it with your face, fingerprint or PIN, then uses the private key to answer the challenge. The website checks the answer with the public key and lets you in. Your fingerprint or face never leaves your device; it only unlocks the passkey.

Why passkeys stop phishing

With a password, a convincing fake login page can trick you into typing your password, and the scammer can then use it. A passkey is tied to the real website address it was made for. If you land on a look-alike site, your device simply will not offer the passkey, and there is nothing for you to type or give away. And because the website only holds public keys, a data breach at the company does not expose anything a criminal can sign in with. To brush up on fake messages anyway, see our guide to spotting a phishing email.

Where passkeys are stored

A passkey is saved by a “passkey manager” (sometimes called a credential manager). Which one you use depends on your devices:

Where it is saved	Works best on	Syncs to your other devices?
iCloud Keychain (viewable in the Passwords app on recent Apple devices)	iPhone, iPad, Mac	Yes, across Apple devices signed in to the same Apple Account
Google Password Manager	Android phones, Chrome	Yes, where you are signed in to the same Google Account
Windows Hello	Windows 11 PCs	Usually kept on that PC only
Third-party password managers (for example 1Password, Bitwarden or Dashlane)	Most devices and browsers	Yes, through the password manager
Hardware security key	Any device with a USB or NFC port	No, the passkey stays on the key

Synced passkeys are the most convenient: make one on your phone and it is ready on your tablet or laptop too. The FIDO Alliance says this syncing is end-to-end encrypted. On current Windows 11, you can see the passkeys saved on your PC under Settings > Accounts > Passkeys. If Windows Hello itself is giving you trouble, see Windows Hello PIN not working.

How to create a passkey for your Google Account

You need a device with a screen lock turned on, and a reasonably up-to-date browser and operating system.

1. On the phone or computer where you want the passkey, sign in to your Google Account.
2. Go to myaccount.google.com/signinoptions/passkeys (or open your Google Account and choose Security & sign-in, called Security on some versions, then Passkeys and security keys).
3. Select Create a passkey, then confirm.
4. Unlock your device with your face, fingerprint or PIN when asked.
5. Repeat on any other device that does not share the same passkey manager.

Android phones signed in to your Google Account may already have a passkey created for you automatically; you will see it listed on the same page.

How to add a passkey to a Microsoft account

For a personal Microsoft account (Outlook.com, Hotmail, Xbox, Microsoft 365 Personal or Family):

1. Sign in at account.microsoft.com and open Security.
2. Open the advanced sign-in options page (Microsoft has labelled it Advanced security options or Manage how I sign in).
3. Choose Add a new way to sign in or verify.
4. Select Face, fingerprint, PIN, or security key and follow your device’s prompts.
5. When asked, pick where to save the passkey: Windows Hello, your phone, a password manager or a security key.

Work and school accounts are different: your organization decides whether passkeys are allowed, so ask your IT department.

Signing in on another device with a QR code

Your passkey does not have to be on the computer you are using. If it is saved on your phone:

1. On the computer’s sign-in page, enter your username, then choose the option to use a passkey (on Google it is Try another way, then Use your passkey).
2. Choose to use a phone or another device. A QR code appears.
3. Scan the QR code with your phone’s camera.
4. Unlock your phone with your face, fingerprint or PIN.

Bluetooth must be on for both devices. This is not for pairing; it lets your phone confirm it is physically near the computer, so a scammer far away cannot use a stolen QR code to get in. Only scan a sign-in QR code that you started yourself on your own screen; never scan one that someone sends you. Our security guides cover more scams to watch for.

What happens if you lose your phone

Do not panic. What happens depends on where your passkeys were saved:

• Synced passkeys (iCloud Keychain, Google Password Manager, a password manager) come back when you sign in to that service on a replacement device.
• Device-only passkeys (for example some Windows Hello passkeys or a hardware key) are gone with the device. You will need another way into the account, then you can make a new passkey.

Either way, from another device, sign in to your account and remove the passkey belonging to the lost phone. Google lets you do this under Security & sign-in, then Passkeys and security keys, or by signing the lost device out under Your devices. This is also why you should keep a recovery email, phone number or backup codes up to date; our guide to setting up two-factor authentication shows how to save backup codes.

Passkeys vs passwords vs two-factor authentication

	Password	Password + 2FA	Passkey
Something to remember	Yes	Yes	No
Can be phished on a fake site	Yes	Sometimes (codes can be phished too)	No
Reused across sites	Often	Often	Never, each is unique
Steps to sign in	One	Two	One (unlock your device)

A passkey is not quite the same as two-factor authentication, but it gives similar protection in a single step: you need your device (something you have) and your face, fingerprint or PIN (something you are or know). Many accounts still keep your password as a fallback, so it should remain strong and unique. A password manager helps with that, and many of them now store passkeys too.

Tips and common questions

• Not every site supports passkeys yet. Look for “passkey” in a site’s security or sign-in settings.
• A shared family computer can be a risk: anyone who can unlock that device can use passkeys saved on it. Save passkeys only on devices you control.
• Scam warning: no genuine company will call or text you asking you to read out a code, scan a QR code they send, or create a passkey while they “help”. If that happens, hang up and go to the company’s website yourself.

For more on keeping your accounts safe, browse our accounts guides.