Passkeys Explained: Are They Really Safer Than Passwords?
Passkeys are a newer way to sign in that removes the password entirely. Instead of typing a secret that can be guessed, stolen or phished, your device proves it is you with a cryptographic key. Major platforms and many websites now support them. Here is how they work and whether you should switch.
How a passkey works
When you create a passkey, your device generates two linked keys. The public key is stored by the website. The private key stays on your device, protected by your fingerprint, face or screen lock. To sign in, the site sends a challenge, your device signs it with the private key after you confirm, and the site verifies the signature using the public key. Your private key never leaves the device, and there is no password to steal from the website.
Why passkeys resist phishing
A passkey is bound to the real website address. If you land on a fake login page, your device will not offer the passkey because the domain does not match. That removes the most common trick behind phishing attacks. There is also nothing for attackers to reuse if a site is breached, because the site only holds public keys.
Passkeys versus passwords with two-factor authentication
| Password + 2FA | Passkey | |
|---|---|---|
| Can be phished | Often, especially with codes | Resistant by design |
| Reusable across sites | Yes, if you reuse passwords | No, unique per site |
| Convenience | Type password and code | One tap or scan |
| Support | Almost everywhere | Growing, not universal |
The downsides
- Not every site supports them yet. You will still need passwords for many accounts.
- Recovery matters. If you lose every device, you need a recovery method, so keep account recovery options up to date.
- Ecosystem lock-in. Passkeys can sync through your Apple, Google or Microsoft account or a compatible password manager, but moving them between systems can be awkward.
How to start using passkeys
- Turn on a screen lock and make sure your device is up to date.
- On important accounts such as Google, Apple, Microsoft and your bank, look for a “passkey” option in the security settings.
- Create the passkey and confirm with your fingerprint, face or PIN.
- Keep a backup sign-in method until you are comfortable.
