Passkeys vs passwords: how passkeys work
A passkey is a sign-in credential that replaces your password with a pair of cryptographic keys: one stays on your phone, computer, or security key, the other on the website. You unlock it with your fingerprint, face, or device PIN. Because each passkey only works on the site it was created for, it cannot be typed into a fake login page.
What a passkey is and how it works
A passkey is a way to sign in without a password. When you create one for a website, your device generates two linked keys: a private key that stays with you and a public key that the website keeps. To sign in, you unlock your device as usual and it proves that it holds the private key, without ever sending it. That is the short version of the FIDO Alliance’s definition, and passkeys are the strongest everyday option in our guide to protecting logins beyond the password.
The word is generic, like “password.” Apple, Google, Microsoft, and the password managers all use the same open standards, which is why you can use a passkey stored on an iPhone to sign in on a Windows computer, by scanning a QR code.
What happens when you sign in
- You visit a site and choose to sign in with a passkey.
- The site sends a random challenge.
- Your device asks you to confirm with your fingerprint, face, or PIN. That unlocks the private key on the device; your fingerprint never leaves it.
- The device signs the challenge and returns the signature.
- The site checks the signature with the public key it stored when you created the passkey.
A separate passkey is created for each site and each account. If a website’s database is stolen, the attackers get only public keys, which cannot be used to sign in.
Why fake login pages fail
This is what sets passkeys apart. Your browser tells your device which website is asking, and the device only answers if that address matches the site the passkey was created for. The FIDO Alliance’s Passkey Central explains that a passkey for a site will simply not be offered on a look-alike address. You do not need to spot the fake: the check happens without you.
NIST, in its 2025 guidelines, calls this “verifier name binding” and counts it among the only mechanisms that resist phishing. Codes from apps or text messages do not, because you can type them anywhere.
Synced and device-bound passkeys
There are two kinds, and the difference matters for recovery:
- Synced passkeys are copied between your devices by a cloud service: iCloud Keychain and the Passwords app on Apple devices, Google Password Manager, or a password manager such as 1Password or Bitwarden. Lose your phone and they are still on your other devices.
- Device-bound passkeys never leave the device or security key that created them. They give the highest assurance, but losing the device means losing the passkey, so you need a spare.
NIST accepts synced passkeys for most purposes, provided the cloud account that syncs them is itself protected by multifactor authentication, but not for its highest assurance level, which requires keys that cannot be copied.
Passkeys compared with passwords and 2FA
| Password | Password plus app code | Passkey | |
|---|---|---|---|
| Something to remember | Yes | Yes | No |
| Resists fake login pages | No | No | Yes |
| Works if you lose your phone | Yes | With backup codes or a synced app | Yes if synced, or with a spare key |
The FIDO Alliance argues that a passkey on its own is more secure than a password combined with a one-time code or a phone approval, and the UK’s NCSC describes passkeys as a more secure alternative to passwords and traditional 2-step verification.
The limits to know
- The syncing account becomes the key to everything. Canada’s Cyber Centre, in its passkey guidance, warns that a passkey stored in a weakly protected cloud account is easier to obtain. Protect your Google, Apple, or password manager account with its strongest second factor.
- Old methods often stay as fallbacks. Adding a passkey to a Google Account does not remove your other sign-in methods, so a password and text codes may still work as alternatives. Remove the weaker ones where you can.
- Anyone who can unlock your device can use your passkeys. Google advises creating passkeys only on devices you personally own and use.
- Not every site supports them yet, so passwords and second factors remain necessary for a while.
- Moving between providers is uneven. Some password managers can export passkeys or use a credential exchange format; NordPass, for example, says its passkeys cannot be imported or exported.
Setting them up on your main accounts
The big three platforms each handle passkeys a little differently. Follow the setup steps for Google, Microsoft, and Apple, including how to remove a passkey.
Device-bound passkeys on a key
If you want passkeys that never sync to a cloud, a hardware key is the way. Read what a security key costs and who needs one.