Passwords fail in two boring, predictable ways. People reuse them, so one leaked password opens five accounts. And people type them into convincing fake login pages, so attackers don’t even need a leak.
Passkeys are built to remove both problems. You still sign in with something familiar, your fingerprint, your face or your phone’s PIN, but there is no password behind it to reuse or give away.
What is actually going on
When you create a passkey for a site, your device makes a matched pair of cryptographic keys. The site keeps the public half. The private half stays with you, on your phone, your computer or a hardware security key. At sign-in, the site sends a challenge, your device signs it with the private key after you unlock it, and the site checks the signature with the public key.
Two things follow from that. First, a hacked website leaks only public keys, which are useless on their own. Second, each passkey is tied to the exact website it was made for. A lookalike site at a slightly different address simply can’t use it, so the classic “enter your password here” phishing email stops working.
Syncing and switching devices
Most passkeys today are synced. Apple’s iCloud Keychain, Google Password Manager and third-party managers copy them across your devices, and the FIDO Alliance, the industry group behind the standard, says that syncing is end-to-end encrypted. Lose your phone, sign in on the new one, and your passkeys come back.
Need to log in on a computer that isn’t yours? The browser will usually offer a QR code instead. Scan it with your phone, approve on the phone, and the passkey itself never gets copied to the other machine.
How many people use them
Adoption is further along than many people assume. In a 2024 survey commissioned by the FIDO Alliance, 53% of people said they had turned on passkeys for at least one account, and 22% had done it for every account that offered them.
Setting up your first passkey
- Start with your main email account. It is the one that resets every other password, so it matters most.
- Open its security settings and look for “passkeys” or “passwordless sign-in”.
- Create the passkey and approve it with your fingerprint, face or PIN.
- Keep a second way in, such as a recovery code stored somewhere safe or a passkey on a second device.
- Repeat for your bank, your password manager and your main shopping and social accounts.
Things to watch for
- Some sites still keep your old password active alongside the passkey. If it is weak, change it or remove it.
- Moving between ecosystems, say from iPhone to Android, can mean setting passkeys up again unless you use a cross-platform password manager.
- Shared family accounts are awkward, because a passkey belongs to one person’s device.
Passkeys vs passwords plus two-factor codes
If you already use a password with a six-digit code from an app or a text message, you are well ahead of most people. But codes can still be phished: a fake login page can ask for your password and your code, then pass both to the real site within seconds. A passkey can’t be relayed that way, because your device checks the website’s address before it signs anything. It is also faster, since there is nothing to type and no code to wait for.
That doesn’t make two-factor codes useless. Keep them turned on for accounts that don’t support passkeys yet, and prefer an authenticator app over text messages where you can.
What happens if you lose everything?
This is the worry most people raise, and it deserves a straight answer. If your passkeys are synced and you can sign back in to your Apple, Google or password manager account, they come back on a new device. The risk is losing access to that account itself. So protect it carefully: set up its recovery options, write down any recovery key it gives you, and store that somewhere safe at home. A second device, such as an old tablet or a hardware key kept in a drawer, gives you a spare way in.
What we think
Passkeys are one of the few security upgrades that are also easier to use, which is why they are actually catching on.
If you do only one thing this week, add a passkey to your email account. Everything else can follow over time, account by account, as sites prompt you.