Setting up passkeys on Google, Microsoft and Apple accounts

How to create a passkey on your Google, Microsoft and Apple accounts

Start with the account that matters most, usually your main email, and create the passkey from a phone or computer you own. On Google and Microsoft, you add it from the account’s security settings; on Apple devices, passkeys are created when a website offers one and stored in iCloud Keychain. This is the practical step that follows our explanation of switching to passkeys, and Google’s passkey help page is a good model of what to check first.

Menu names change from time to time; the paths below are those published by each provider on November 10, 2026.

Before you start

• Use your own devices only. Google points out that anyone who can unlock the device can use the passkeys on it.
• Turn on a screen lock (PIN, fingerprint, or face), which passkeys rely on.
• Check the requirements. For a Google Account: Windows 10, macOS Ventura, or ChromeOS 109 or later on a computer; Android 9 or iOS 16 or later on a phone; and a recent browser (Chrome or Edge 109, Safari 16, Firefox 122 or later). Bluetooth is needed to use a phone’s passkey on a computer.
• Keep another way in. Do not remove your other sign-in methods until the passkey has worked a few times.

Google Account

1. Go to your Google Account, then Security & sign-in, then Passkeys and security keys (or myaccount.google.com/signinoptions/passkeys).
2. Choose the option to create a passkey and confirm with your screen lock. To store it on a security key, choose Use another device.
3. Sign out and back in to test it.

What to know: Google says a passkey replaces the second step of 2-Step Verification, and that adding one does not remove other factors, so your password and other methods keep working as alternatives. A new passkey can take up to seven days to be offered at sign-in. If you use a Google Workspace account from your employer, the administrator may not allow signing in with a passkey alone.

To remove a passkey, for example after losing a device: Security & sign-in, Passkeys and security keys, select it, then Remove. If Android created it automatically, sign the lost device out of your account instead, under Manage all devices.

Personal Microsoft account

Microsoft introduced passkeys for personal accounts on May 2, 2024, and since May 1, 2025 new Microsoft accounts are passwordless by default.

1. Go to account.live.com/proofs/manage (the advanced security options of your Microsoft account).
2. Choose Add a new way to sign in or verify, then Face, Fingerprint, PIN, or Security Key.
3. Choose where to save it: a password manager that syncs (Microsoft’s, Google’s, or iCloud Keychain), a phone or tablet through a QR code, a security key, or Windows Hello on the computer itself.

To remove one, go back to the same page, expand the passkey, and choose Remove; make sure another sign-in method is in place first. A passkey stored in Windows can also be deleted from Settings, Accounts, Passkeys. If the passkey lives in a password manager, delete it there too.

Apple devices

Apple devices do not need a separate setup: when a website or app offers a passkey, your iPhone, iPad, or Mac creates it and saves it in iCloud Keychain, where it appears in the Passwords app. According to Apple’s iPhone guide, passkeys require iCloud Keychain and two-factor authentication to be turned on. They are then available on your other Apple devices signed in to the same Apple Account, and you can sign in on someone else’s computer by scanning a QR code with your iPhone.

To delete a passkey on an iPhone: open Passwords, then Passkeys, select the account, tap Edit, then Delete. If you shared a passkey through a shared group with someone who should no longer have access, Apple suggests replacing it.

Protect the Apple Account itself with two-factor authentication and, if you want the strongest option, security keys: Apple requires at least two.

In a small team

The UK’s NCSC, in its guide for small organizations, recommends enabling passkeys for staff email accounts as a priority where the provider supports them. In Google Workspace and Microsoft 365, the administrator controls which methods are allowed, so start with the admin console before asking colleagues to switch.

Understanding what you just set up

If you want to know why a passkey resists fake login pages, and the difference between synced and device-bound ones, read how passkeys work, step by step.

Before you lose a device

Synced passkeys survive a lost phone, but the account behind them must stay reachable. Our guide to keeping access when your phone changes covers backup codes and recovery for each platform.