Passkeys Explained: How to Replace Your Passwords Without Locking Yourself Out

Passwords have been the default way to prove who we are online for so long that it is easy to forget how badly they work. People reuse them, write them down, forget them and type them into convincing fake websites. Data breaches leak them by the million. Passkeys are the most serious attempt yet to retire them, and they are now supported by most major operating systems, browsers and a growing list of websites.

If you have seen a prompt asking whether you would like to "create a passkey" and wondered whether to say yes, this guide covers what you need to know.

How a passkey works

A passkey is built on a well-established technique called public-key cryptography. When you create one for a website, your device generates a pair of mathematically linked keys. The public key is sent to the website and stored on its servers. The private key stays on your device, or in your password manager, and never leaves it.

When you sign in, the website sends a random challenge. Your device uses the private key to sign that challenge, after you confirm it is you with a fingerprint, face scan or device PIN. The website checks the signature against the public key it holds. If they match, you are in.

The important consequence is that there is no shared secret for anyone to steal. A breach of the website exposes only public keys, which are useless on their own. And because each passkey is tied to the genuine web address it was created for, a fake site with a similar-looking address simply cannot request a valid signature. That makes passkeys resistant to phishing in a way that passwords and even text-message codes are not.

Synced versus device-bound passkeys

There are two broad flavours, and the difference matters for convenience and recovery.

Synced passkeys are stored in a cloud-backed credential manager, such as the one built into your phone's operating system or a third-party password manager. They are encrypted and copied to your other signed-in devices, so a passkey created on your phone can also be used on your tablet or laptop.

Device-bound passkeys live on a single piece of hardware, typically a physical security key that plugs into a USB port or taps against a phone. They never sync anywhere. This is more secure in some threat models, which is why they are popular with journalists, administrators and others who face targeted attacks, but losing the key means losing that credential.

For most people, synced passkeys strike the right balance. A security researcher in Berlin who trains small charities on account protection described the change in practical terms.

Most of the people I help were never going to use long unique passwords everywhere, but they will happily touch a fingerprint sensor, and that alone removes the most common way accounts get stolen.

Setting them up sensibly

The rollout is gradual, so you will likely run passkeys and passwords side by side for some time. A sensible approach is to start with the accounts that matter most:

• Your primary email account, since it is used to reset almost everything else.
• Your password manager or the account that holds your synced credentials.
• Banking and payment services that support passkeys.
• Work accounts, following your employer's guidance.
• Social media accounts that would be damaging if hijacked.

Look in each service's security or sign-in settings for an option to add a passkey. Your device will prompt you to confirm with biometrics or a PIN, and the passkey will be saved to your chosen credential manager. Try signing out and back in once to make sure it works before you rely on it.

Planning for lost or broken devices

The most common worry about passkeys is getting locked out. It is a fair concern, and the answer is to plan recovery before anything goes wrong.

First, make sure your synced passkeys are backed up to an account you can recover. That usually means having a strong, unique password and an up-to-date recovery phone number or email for the cloud account itself, plus any recovery codes the provider offers. Store those codes somewhere physical and safe.

Second, register more than one way in for critical accounts. Many services allow several passkeys, so you might add one from your phone, one from your laptop and, if you want extra resilience, a hardware security key kept in a drawer.

Third, do not rush to delete passwords from every account. Some sites still fall back to a password if a passkey fails, and that fallback can be removed later once you are comfortable.

Limitations worth knowing

Passkeys are not perfect. Moving them between competing ecosystems has historically been awkward, although industry work on standard export formats is improving that. Shared family accounts can be harder to manage, since a passkey is tied to one person's device or manager. And some older websites and apps will not support them for years.

They also do nothing to protect you if your unlocked device is in someone else's hands, or if malicious software is already running on it. Basic hygiene, including software updates and a screen lock, remains essential.

Still, for the everyday threats that cause most account takeovers, such as reused passwords and convincing phishing emails, passkeys are a significant step forward. Setting up a handful on your most important accounts, with a clear recovery plan alongside, is one of the more worthwhile hours you can spend on your digital security this year.