What Is a Passkey? A Plain-English Guide

A passkey is the thing that finally lets you sign in to a website the same way you unlock your phone: a fingerprint, a face scan, or a PIN — no password to type, remember, or leak. That’s the whole idea in one sentence. The reason it’s worth understanding beyond that sentence is that passkeys quietly fix the single most common way ordinary people get hacked, and the industry is rolling them out fast enough that you’ll be asked to “add a passkey” on account after account this year.

The short version, before the details

If you only take three things from this guide, take these:

1. A passkey is a password replacement, not another password. Nothing to type, nothing to memorize.
2. It’s phishing-proof by design. A fake login page can’t harvest a passkey the way it harvests a typed password and a texted code.
3. Where you store it decides how convenient it is. A password manager is usually the best home because your passkeys then work on every device and every brand of phone or computer, not just one.

Everything below is the “why” behind those three sentences, plus the honest catches nobody puts in the marketing.

What a password actually is (and why that’s the problem)

To see why passkeys matter, it helps to be clear about what a password is: a shared secret. You know it. The website stores a version of it. That sharing is the built-in weakness. Anything that copies the secret can reuse it — and there are a lot of ways to copy a secret:

• A breach at the website spills millions of them at once. If you reused that password anywhere, attackers now try it everywhere (this is the industrial attack we describe in our guide to ending password reuse).
• A phishing page — a fake login screen at a lookalike address — tricks you into typing the secret straight into an attacker’s hands.
• Guessing works far more often than people think, because human-chosen passwords follow patterns cracking software already knows.

Two-factor authentication (2FA) — a texted code, or a number from an authenticator app — was invented to patch this. It helps a lot. But it’s still a secret you hand over: a good-enough phishing site can ask for your password and your code, then relay both to the real site in real time before the code expires. That’s the gap passkeys were built to close.

How a passkey works (no jargon, promise)

A passkey isn’t one secret — it’s a pair of keys that are mathematically linked:

• A private key, which stays locked on your device and never leaves it.
• A public key, which the website keeps. It’s called public because it’s useless to a thief — it can check a signature but can’t create one.

When you sign in, the website sends your device a puzzle. Your device unlocks the private key (that’s the fingerprint/face/PIN moment) and uses it to “sign” the puzzle. The website checks the signature against the public key it’s holding. Match confirmed, you’re in — and the secret half never travelled across the internet at all.

Chew on what that removes:

• Nothing reusable is stored on the website. A breach spills a pile of public keys, which are worthless to attackers. There is no password list to leak.
• Nothing to phish. The private key never leaves your device, so there’s no secret for you to accidentally type into a fake page.
• Nothing to guess. The key is long and random by construction, not something you chose because it was memorable.

And here’s the mechanism that makes passkeys genuinely phishing-proof, not just phishing-resistant: a passkey is bound to the real website’s exact domain. Your device will only offer a site’s passkey to that site. Land on a convincing fake at a slightly-wrong address and your device simply won’t have a passkey to offer — the copycat page gets nothing, because there’s nothing there for it to take. The most convincing scam in the book stops working.

“Unlocked by your fingerprint” — where does my face/finger go?

A fair worry, and the answer is reassuring: your fingerprint and face never leave your device, and no website ever receives them. The biometric is only a local lock — it tells your own phone or laptop to release the private key it’s already holding. To the website, every passkey sign-in looks the same whether you used a fingerprint, a face scan, or a PIN. You can think of the biometric as the key to your own drawer, not something you mail anywhere.

Passkeys vs passwords vs 2FA, side by side

	Password	Password + SMS/app 2FA	Passkey
Something to remember	Yes	Yes	No
Exposed by a website breach	Yes	Password is	No — site holds only a useless public key
Can a phishing page capture it	Yes	Yes (a real-time fake can relay the code)	No — bound to the real domain
Vulnerable to password reuse	Yes	Yes	N/A — nothing reusable exists
Sign-in speed	Type it	Type it, then wait for a code	Fingerprint/face, done

The pattern is clear: passkeys aren’t a small upgrade over “password plus code.” They remove the class of problem those measures were patching.

Where passkeys live — and why this is the decision that matters

This is the part most explainers skip, and it’s the part that determines whether passkeys feel magical or maddening. When you create a passkey, it gets saved somewhere, and you usually get a choice:

• Your platform’s built-in store. Save to an iPhone or Mac and it syncs through Apple’s iCloud Keychain. Save on Android or in Chrome and it syncs through Google Password Manager. On Windows, through Microsoft. These are good, secure, and free — with one catch: they’re most seamless inside their own ecosystem. A passkey born on your iPhone is effortless on your Mac and awkward the day you pick up an Android phone.
• A password manager. Save the passkey into Bitwarden, 1Password, or a similar tool, and it syncs with the manager across every device and operating system you own — Windows laptop, iPhone, Android tablet, all the same.

For most people who use more than one brand of device — which is most people — a password manager is the better home, for the same reason it’s the better home for passwords: your logins shouldn’t be trapped inside one company’s walls. If you live entirely in one ecosystem (all Apple, say), the built-in store is perfectly fine too. There’s no wrong answer here; there’s just “pick one deliberately so your passkeys sync and you’re not locked in.”

The honest catches nobody warns you about

Passkeys are genuinely better, and we’d still be doing you a disservice if we pretended they were frictionless. The real caveats:

• Adoption is partial and will be for years. A growing list of major services supports passkeys, but the long tail of sites you use will demand passwords for a long time yet. You’re not throwing passwords away in 2026 — you’re adding a better option where it exists.
• The fallback password often still exists. Most sites keep your password active alongside the passkey. That’s convenient, but it means the account is only as strong as its weakest door — a strong passkey doesn’t help if the old password on the same account is “password123.” Keep the fallback strong and unique.
• Recovery deserves thought up front. Your passkeys are only as safe as the account (platform or manager) that syncs them. Secure that account properly — strong master passphrase, its own 2FA — because it’s now the master key. This is the same lesson as the master password on a vault.
• Sharing is still maturing. Handing a passkey to a family member is getting easier but isn’t as frictionless as sharing a password yet. For shared logins today, a password manager’s sharing is often the smoother path.
• The word is used loosely. You’ll see “passkey” cover a few closely-related things — a synced passkey in the cloud, or one bound to a single physical security key. For everyday purposes, “synced passkey stored in your platform or password manager” is what people mean, and what we mean here.

None of these are reasons to avoid passkeys. They’re reasons to adopt them with your eyes open — turn them on where offered, store them somewhere that syncs, and keep your fallback passwords respectable.

Should you use passkeys? (Yes — here’s the simple rule)

The rule is refreshingly boring: when a service you’re signing into offers to add a passkey, say yes. It’s more secure and it’s faster, so there’s rarely a reason not to. Don’t turn it into a scavenger hunt across every account you own — add them opportunistically as sites offer them, and deliberately seek them out only for your most important accounts (email, banking, cloud storage, your primary social and shopping accounts). That prioritized list is the same one we walk through in our afternoon plan to secure your accounts.

And decide your storage home once, at the start. If you already use a password manager, let it hold your passkeys and you’re done — everything syncs, nothing’s locked to one brand. If you don’t yet, this is one more good reason to get one; our guide to ending password reuse covers the picks. When you’re ready to actually turn passkeys on, our step-by-step how to set up passkeys walks through it on the major platforms.

Passkeys are the rare security upgrade that makes your life easier while making you safer — no memorizing, no typing, no falling for a fake login page. That combination is why they’re the direction the whole industry is moving. This guide is part of our Privacy & Security Kit, where the password manager comparison and the account-security plan fit alongside it.