How Passkeys Work, and Why They’re Replacing Passwords

Passwords have a problem: they are secrets that we have to share. Every time you sign in, you type your secret and send it to a website. If the website is hacked, or if you are tricked into typing it on a fake site, the secret is out. And because remembering dozens of strong passwords is nearly impossible, many people reuse the same few.

Passkeys are designed to fix this. Instead of a secret you know and share, they use a secret your device keeps to itself.

What a passkey is

A passkey is a digital key, stored on your phone, computer or password manager, that lets you sign in to one particular website or app. To use it, you unlock it the same way you unlock your phone: with your fingerprint, face or screen-lock PIN.

Passkeys were developed by the FIDO Alliance, an industry group, together with the World Wide Web Consortium (W3C), which sets standards for the web. In 2022, Apple, Google and Microsoft committed to supporting them across their systems. Many large services, including Google, Apple, Microsoft, Amazon, PayPal and WhatsApp, now offer them.

A password is a secret you share. A passkey is a secret your device never gives away.

How it works, in plain language

Passkeys use a well-tested method called public-key cryptography. When you create a passkey, your device makes two linked keys:

• A private key, which stays on your device (or in your password manager) and is never sent anywhere.
• A public key, which is sent to the website and stored with your account.

The two keys are mathematically linked. Something locked with the private key can be checked with the public key, but you can’t work out the private key from the public one.

When you sign in:

1. The website sends your device a random challenge, a one-time puzzle.
2. Your device asks you to confirm it’s you, with your fingerprint, face or PIN.
3. Your device uses the private key to sign the challenge and sends back the answer.
4. The website checks the answer with your public key. If it matches, you’re in.

Your fingerprint or face never leaves your device either. It only unlocks the passkey locally, in the same way it unlocks your phone.

Why passkeys are safer

Nothing useful to steal from the website

If a website that uses passkeys is hacked, the attackers get only public keys. Those can’t be used to sign in anywhere. Compare that with passwords, where leaked password lists are bought, sold and tried on other sites.

Phishing doesn’t work

Phishing tricks you into typing your password on a fake website that looks real. A passkey is tied to the real website’s address. On a look-alike site, your device simply won’t offer the passkey, because the address doesn’t match. You can’t be tricked into handing it over, even by a very convincing fake.

No reuse, no weak passwords

Each passkey is unique to one website and is strong by design. There’s nothing to guess, and nothing to reuse.

What if I lose my phone?

This is the most common worry. In most cases, passkeys are synced through a password manager, such as iCloud Keychain on Apple devices, Google Password Manager on Android and Chrome, Microsoft’s, or independent managers like 1Password or Bitwarden. Your passkeys are backed up in encrypted form, and when you sign in to your new phone with that account, they come back.

A few things to check:

• Make sure your password manager account itself is well protected, with a strong password and two-factor authentication.
• Keep at least one other way to get into important accounts, such as a second device, recovery codes or a recovery email.
• Some passkeys, such as those on hardware security keys, aren’t synced. If you use one, register a spare.

Using a passkey on someone else’s computer

You can sign in on a computer that doesn’t have your passkey by using your phone. The computer shows a QR code; you scan it with your phone and confirm with your fingerprint or face. The phone and computer check that they are physically close, using Bluetooth, so this can’t be done by someone far away.

How to start

1. Look for “passkeys” in the security settings of accounts you use often, such as your email, Google, Apple or Microsoft account, and online shops.
2. Create a passkey when offered. Your phone or computer will guide you, usually in a few seconds.
3. Keep your password for now on most sites. Many services still let you sign in with a password too, so you won’t be locked out while you get used to passkeys.