Passkeys Explained: How They Work and How to Set Them Up
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A summary of passkey documentation from Apple, Google and Microsoft, plus CISA's MFA guidance (linked below), checked October 28, 2026. Menus and supported versions change, so follow each provider's current help page.
More and more sites now offer to "create a passkey" when you sign in. A passkey replaces a password with the same unlock you already use on your phone or computer: a fingerprint, a face scan or a device PIN. Here is how they work and where to start.
What a passkey is
Apple's passkey security overview explains that passkeys are built on the WebAuthn standard and use public key cryptography. When you create a passkey, your device generates a pair of keys for that one account:
- The public key is stored by the website. It isn't secret.
- The private key stays with you, and the website never learns it.
When you sign in, your device uses the private key to prove it's you, after you unlock it with Face ID, Touch ID, Windows Hello or your phone's screen lock. Apple notes that no shared secret is sent, so there's nothing reusable for a site to leak.
Why they're safer than passwords
- Phishing-resistant. Apple, Google and Microsoft all describe passkeys as resistant to phishing. There's no password for you to type into a fake login page.
- Always strong and unique. Microsoft's passkey page says each passkey is unique to one site or app, so one breach doesn't expose your other accounts.
- Nothing to hand over. Google's passkey help page says passkeys can't be shared, copied, written down or accidentally given to someone else. It also says your fingerprint or face data stays on your device and isn't shared with Google.
CISA's multifactor authentication page (now in CISA's archive) says not all MFA is equal: phishing-resistant MFA is the standard to strive for, and "the only widely available phishing-resistant authentication is FIDO/WebAuthn," the technology passkeys use. CISA explains that if someone tricks you into logging in to a fake website, the FIDO protocol blocks the attempt. It adds that any MFA is better than none.
Where your passkeys live
Passkeys are saved in a credential manager:
- Apple devices: iCloud Keychain syncs passkeys across your Apple devices. Apple says it is end-to-end encrypted, and it requires two-factor authentication on your Apple Account.
- Windows: Microsoft says you can save passkeys on the device (using Windows Hello) or in a synced credential manager such as Microsoft Password Manager, so they work on your other devices.
- Google accounts and Android: Google's help page covers creating passkeys for your Google Account on supported phones, computers and security keys.
- Hardware security keys that support FIDO2 can also hold passkeys.
If you save a passkey only on one device, Microsoft suggests creating passkeys on your other devices too, as a "digital spare key."
What you need
Google lists these minimums for using a passkey with a Google Account:
| Item | Minimum |
|---|---|
| Computer | Windows 10, macOS Ventura or ChromeOS 109 |
| Phone | Android 9 or iOS 16 |
| Browser | Chrome 109, Safari 16, Edge 109 or Firefox 122 |
| Other | Screen lock turned on; Bluetooth on to use your phone to sign in on another computer; iCloud Keychain on for Apple devices |
How to start
- Begin with your most important accounts: your main email, your Microsoft, Apple or Google account, your bank and your domain registrar. Email matters most because it can reset everything else.
- Accept the prompt when a site offers to create a passkey, or look under the account's security settings.
- Add a second passkey on another device, or use a synced manager, so losing one phone doesn't lock you out.
- Keep your recovery options current. Google notes that adding a passkey doesn't remove your existing sign-in or recovery methods. It also says a passkey skips the 2-Step Verification step, because using it already proves you have the device.
For accounts that don't support passkeys yet, use a password manager and an authenticator app. See our guide to passwords and MFA for a small business. A passkey also makes a hijacked phone number less dangerous. See SIM swap and port-out fraud.