What are passkeys, and should you use them?

Every password problem comes from the same root: a password is a secret you know, and anything you know can be extracted from you — by a convincing page, a persuasive caller, or a breach of somewhere you typed it.

A passkey is not a secret you know. It is a key your device holds and can prove possession of without ever revealing. That single structural change removes most of the categories of attack described everywhere else on this site.

How they work

Registration creates a key pair:

• The private key stays on your device. It is never transmitted, never shown to you, and never sent to the website.
• The public key goes to the service. It is not sensitive — it can only verify signatures, not create them.

Signing in is a challenge and response. The site sends a random challenge, your device signs it with the private key after you approve with a fingerprint, face or PIN, and the site verifies the signature against the public key it holds.

Why they resist phishing

This is the part that matters most, and it is worth being precise about.

A passkey is bound to the domain it was created for. When you land on paypa1-secure.net, your device is asked for a passkey for that domain — and it has none. The genuine passkey is not offered, and cannot be offered, no matter how perfect the replica looks to you.

Compare that to a one-time code. As described in how phishing works, a modern phishing kit acts as a live proxy: it forwards your credentials to the real site, triggers a genuine code to your phone, and relays the prompt. You supply the code, it is used within its validity window, and the attacker holds a session. The code was real. Your vigilance was the only defence, and it was targeted directly.

What using one feels like

Considerably simpler than what it replaces. You visit the site, it asks you to sign in, your device prompts for a fingerprint or face, and you are in. No typing, no code, no app switching, no waiting for an SMS.

The FIDO Alliance — which develops the underlying standards — describes it as signing in "with the same process that they use to unlock their device". That is accurate, and it is why adoption has moved faster than most security changes: the secure option is also the faster one.

The questions people actually have

What if I lose my phone?

Your passkeys survive it. They sync through your platform account (iCloud Keychain on Apple devices, Google Password Manager on Android) or through a password manager that supports them. A new device signs into that account and the passkeys are there.

The corollary is important: the account that syncs your passkeys is now extremely valuable. Protect it with a strong unique password and its own second factor.

Can I use them across different ecosystems?

Yes, though it is the roughest edge. Cross-device sign-in works by scanning a QR code with the phone holding the passkey, which is reliable but not elegant. A cross-platform password manager avoids the issue by holding passkeys itself.

What if someone steals my unlocked phone?

They would need to defeat your device unlock — fingerprint, face, or PIN — to use a passkey, exactly as they would to read your email. The passkey is not weaker than the device it sits on, and a device lock is protection you should have regardless.

Is it available where I need it?

Increasingly, though unevenly. Major platforms, large retailers and many financial services now support passkeys; plenty of smaller services do not. The practical approach is to enable them wherever they appear and keep a strong unique password everywhere else.

What to do now

1. Turn on passkeys where they are offered. Check the security settings of your email, your primary platform account, and anything holding payment details.
2. Secure the syncing account with a strong unique password and a second factor.
3. Keep the fallback password strong. While a password remains on the account, it remains attackable — a passkey does not protect a route it does not cover.
4. Remove the password where the service allows it once the passkey is working on more than one device.

If you are weighing whether to switch, are passkeys safer than passwords sets the two side by side — attack by attack, including what passkeys do not fix.