Passkeys, explained: how logging in without a password works
A passkey replaces your password with a pair of cryptographic keys. One never leaves your device, which is why phishing pages cannot steal it.
Photo: Tony Webster from Minneapolis, Minnesota, United States / Wikimedia Commons, CC BY 2.0
.jpg){kind=link}
More apps and websites now offer to "create a passkey". It is a different way to sign in, built on open standards from the FIDO Alliance and the W3C's WebAuthn specification.
Two keys instead of one secret
When you create a passkey, your device makes a pair of keys. The private key stays with you, on your phone, computer, password manager or a hardware security key. The website only stores the public key, which is useless for signing in on its own.
To log in, the site sends a challenge. Your device signs it with the private key after you unlock it with a fingerprint, your face or a PIN. The site checks the signature with the public key. No password is typed or sent.
Why it stops phishing
A passkey is tied to the exact website it was created for. If a fake site that looks like your bank asks you to sign in, your device will not offer the bank's passkey there. And because the site never holds anything secret, a data breach does not leak credentials that can be reused elsewhere.
Synced or on a key
Most phones and browsers sync passkeys through your account, so a new device can use them after you sign in. Hardware security keys keep the private key on the physical key itself, which never syncs.
Getting started
- Turn on passkeys first for your email account, since it can reset everything else.
- Keep at least one other way to recover your account, such as a second device or recovery codes.
- You do not need to delete your password straight away. Many services let you use both while you get used to it.