What a passkey is and why you might want one
A passkey is a way to sign into an account using your device instead of typing a password. When you create a passkey, your phone, computer, or security key stores a unique code that proves you own the account. You unlock it with your fingerprint, face recognition, or a PIN — something only you can do.
The main reason to use a passkey is that it is harder to steal than a password. A password can be guessed, phished, or leaked from a company's database. A passkey stays on your device and never travels across the internet in a form someone else can intercept or reuse. If a website gets hacked, the passkey itself is not exposed — only a piece of information that is useless without your device.
Not every website offers passkeys yet. Major services like Google, Microsoft, Apple, Amazon, and GitHub do. Smaller sites are adding them gradually. You can still use passwords on sites that do not support passkeys, and you can have both a passkey and a password on the same account for now.
Key Takeaways
- A passkey is stored on your device and unlocked with your fingerprint, face, or PIN instead of a typed password.
- You create a passkey through your account settings on a website or app that supports them, usually under security or sign-in options.
- Your passkey is synced across your devices if you use the same account (Google account, Apple ID, or Microsoft account), so you can sign in from any of them.
- If you lose access to your device, you can still sign in using a backup method the website provides, such as a recovery code or a second passkey on another device.
- Passkeys work best when you have a device with biometric security (fingerprint or face recognition) or a PIN you use regularly.
Where to find the passkey option on common websites
The location of the passkey setting varies by website, but it is usually in your account security settings. On Google, go to myaccount.google.com, select "Security" in the left menu, scroll to "How you sign in to Google," and look for "Passkeys." On Microsoft, visit account.microsoft.com, select "Security" on the left, then "Advanced security options," and find "Passkey." On Apple, go to appleid.apple.com, select "Security," and look for "Passkeys."
GitHub, Amazon, and other services follow a similar pattern: account settings, then security or sign-in options. If you are not sure where to look, search the website's help center for "passkey" or "passkey setup." Most sites have a guide that walks you through the steps.
How to create a passkey on your device
Once you find the passkey option, the website will ask you to confirm your identity — usually by entering your current password or a code sent to your email or phone. This is a security check to make sure you are the account owner.
Next, the website will ask which device you want to create the passkey on. Choose the device you use most often — your phone, laptop, or tablet. The website will then prompt your device to create the passkey. On most phones and computers, this means you will see a dialog asking you to unlock your device using your fingerprint, face, or PIN. Do that, and the passkey is created and stored on your device.
The website will confirm that the passkey was created successfully. Some sites will ask if you want to create additional passkeys on other devices right away. You can do this now or add them later. It is a good idea to have a passkey on at least two devices so you can still sign in if one device is lost or broken.
How passkeys sync across your devices
If you use an iPhone and a Mac, both signed into the same Apple ID, your passkey is automatically available on both devices. The same is true for Android phones and Windows computers signed into the same Google account, or for any devices signed into the same Microsoft account. You do not have to do anything — the sync happens in the background.
This means you can create a passkey on your phone and then sign into that account on your laptop using the same passkey, without creating a separate one. The website recognizes that both devices hold the same passkey and lets you in.
If you switch to a new device or sign out of your account on an old one, the passkey goes with your account. When you sign into your Google, Apple, or Microsoft account on the new device, the passkey is restored automatically.
What to do if you lose your device or forget your PIN
If your phone is lost or stolen, your passkeys are not accessible from that device anymore. However, you can still sign into your accounts on another device that has the same passkey, or you can use a backup sign-in method.
Most websites that support passkeys also ask you to save a recovery code or set up a backup passkey when you create your first one. A recovery code is a long string of characters that you can use to sign in if you lose access to all your devices. Write it down or store it in a secure place — not in a note on your phone or in an email. Some people keep it in a safe or a locked drawer.
If you forget the PIN or biometric (fingerprint or face) on your device, you will need to unlock your device first using your device's own recovery method — usually a backup PIN, a recovery code, or your device account password. Once your device is unlocked, your passkeys are accessible again.
Passkeys versus passwords: when to use each
Use a passkey on any account that supports it and that you sign into regularly. Passkeys are faster to use and more secure than passwords. You do not have to remember them, and they cannot be phished or reused across multiple sites.
Keep using passwords on accounts that do not support passkeys yet. You can also keep a password on an account that has a passkey as a backup — some people do this for important accounts like email or banking, in case they lose access to all their devices.
If you use a password manager (a tool that stores and fills in passwords for you), you can still use it alongside passkeys. The password manager stores your passwords, and your device stores your passkeys. Over time, as more websites add passkey support, you will likely use passwords less and less.
Security considerations when using passkeys
A passkey is only as secure as your device. If someone has physical access to your unlocked phone or computer, they can use your passkeys to sign into your accounts. Lock your device with a strong PIN or biometric when you are not using it, and do not leave it unattended in public.
If you create a passkey on a shared device — a family computer or a work laptop — be aware that anyone who unlocks that device can use the passkey. For shared devices, it is better to use a password that only you know, or to create a separate user account on the device for yourself.
Passkeys are stored locally on your device and synced through your device account (Google, Apple, or Microsoft). These companies use encryption to protect the sync, but the passkey itself never leaves your device in an unencrypted form. If you are concerned about a company having access to your account data, review that company's privacy policy.
Frequently Asked Questions
Can I use the same passkey on multiple websites?
No. Each website creates its own unique passkey for your account. You cannot copy a passkey from one site and use it on another. This is actually a security feature — if one website is hacked, the passkey for that site alone is compromised, not your passkeys for other accounts.
What happens if I delete a passkey by accident?
You can create a new one by going back to your account security settings and following the passkey creation steps again. The website will ask you to confirm your identity first. If you have a recovery code saved, you can use it to sign in while you create a new passkey.
Can I use a passkey on a public or borrowed computer?
It depends on the device. If it is a public computer at a library, you should not create or use a passkey there — use a password instead. If it is a friend's personal computer and you trust it, you can use a passkey, but make sure to sign out of your account when you are done. The passkey will not stay on that device after you sign out.
Do I need a special app to use passkeys?
No. Passkeys are built into modern phones, tablets, and computers. You do not need to download anything. When a website asks you to create or use a passkey, your device's built-in system handles it automatically.
What if a website I use does not support passkeys yet?
Continue using your password for that account. You can check back periodically to see if the website has added passkey support. Many popular services add it gradually, so it may become available in the future.