Passkeys Explained: The Future of Passwordless Login

Passkeys are a newer way to sign in without typing a password. Major platforms including Apple, Google and Microsoft support them, and a growing number of websites offer them.

How passkeys work

A passkey is a pair of cryptographic keys created for one specific website:

• The private key stays on your device or in your password manager, protected by your fingerprint, face or device PIN.
• The public key is stored by the website.

When you sign in, the website sends a challenge. Your device signs it with the private key after you unlock it, and the site checks the signature with the public key. No secret is ever typed or sent.

Why passkeys are more secure

• Phishing resistant. A passkey is tied to the real website's domain, so it will not work on a look-alike fake site.
• Nothing to steal from the server. A breached website only leaks public keys, which cannot be used to log in.
• No reuse. Every passkey is unique to one site automatically.
• No weak choices. Users cannot pick a guessable passkey.

Are passwords going away?

Not yet. Many websites do not support passkeys, and most that do still keep a password as a backup option. For the foreseeable future, you will need both. That backup password should still be strong and unique, ideally created with a password generator.

Getting started

1. Check the security settings of your main accounts, such as email, for a "passkeys" option.
2. Create a passkey on your phone or computer.
3. Make sure your passkeys sync through your platform or password manager, so losing a device does not lock you out.
4. Keep recovery options, such as backup codes, up to date.

Passkeys are one of the biggest improvements in everyday account security in years, and they are worth turning on wherever they are offered.

Frequently asked questions

What are passkeys?

What are passkeys? They are a passwordless login method that uses a cryptographic key pair stored on your device or in your password manager, unlocked with your fingerprint, face or PIN.

How do passkeys work?

How do passkeys work in practice? The website sends a challenge, your device signs it with a private key after you unlock it, and the site checks it with the matching public key. No secret is typed or sent.

Are passkeys safer than passwords?

Yes. Are passkeys safer than passwords? They cannot be guessed, reused or phished on a fake website, and a website breach exposes only public keys.