Explainer

What are passkeys, and are they safer than passwords?

A passkey lets you sign in with your fingerprint, face or screen lock instead of a password. There is nothing to remember and nothing a fake website can steal.

By the How To, Simply team · 1 October 2026 · 3 min read

Replaces

Password and the code sent by text message

You confirm with

Fingerprint, face or your device PIN

Stored in

Your phone or password manager

Works on

iPhone, Android, Mac and Windows

More websites now offer to "create a passkey" when you sign in. Google, Apple, Microsoft, Amazon, PayPal and WhatsApp all support them. A passkey is a newer way to prove who you are, designed to fix the weak points of passwords.

How a passkey works

When you create a passkey, your device makes a pair of keys that belong together.

• The private key stays on your device and is never sent anywhere.
• The public key goes to the website. It is not a secret, and it is useless without the private one.

When you sign in, the website sends your device a challenge. Your device asks for your fingerprint, face or PIN, then answers the challenge with the private key. The website checks the answer with the public key. Your fingerprint or face never leaves the device; it only unlocks the key.

Why it is safer than a password

• Fake websites do not work. A passkey is tied to the real address of the site. On a look-alike page your device simply has no key to offer, so there is nothing to type and nothing to steal. This is the main protection against phishing.
• Data leaks matter less. If a company is hacked, the attackers get public keys, which cannot be used to sign in.
• No reuse. Every site gets its own key pair, so one stolen account does not open the others.
• No codes by text message. A passkey already combines something you have (the device) with something you are or know (fingerprint or PIN).

Where passkeys are stored

On an iPhone or Mac they are saved in Apple's Passwords app and synced through iCloud Keychain. On Android and in Chrome they are saved in Google Password Manager. Password managers such as 1Password and Bitwarden can hold them too. Because they sync, a passkey made on your phone also works on your other devices signed in to the same account.

What if you lose your phone?

Your passkeys are not lost if they are synced. Sign in to your Apple or Google account on the new phone and they come back. That makes the account that holds them the important one: protect it with a strong password, two-step verification and up-to-date recovery details.

Most websites also keep another way in, such as your old password or an email link, in case you lose every device.

Signing in on someone else's computer

Choose the option to use a phone. The computer shows a QR code, you scan it with your phone and confirm with your fingerprint or face. The phone and the computer check over Bluetooth that they are really next to each other. The passkey itself stays on your phone.

Should you switch?

Yes, starting with the accounts that matter most: your email, your Apple or Google account, and anything connected to money. Add a passkey when the site offers one. You do not have to delete the password on the same day. Keep it in a password manager as a fallback until you are comfortable.

The limits

• Not every website supports passkeys yet.
• Moving passkeys between Apple's and Google's systems is still less smooth than within one of them.
• Anyone who knows your phone's PIN can use your passkeys, so choose a PIN that is not easy to guess.