What Is a Passkey? The Password Replacement, In Plain English
A passkey replaces your password with a key pair: the site keeps the public half, your device keeps the private half. Sign in with a fingerprint instead.
By Galactic News Editorial · Published 2026-11-08T19:33:50+00:00 · Updated 2026-11-08T19:33:50+00:00
A passkey is a safer replacement for a password. It lets you sign in with your fingerprint, face, PIN or pattern instead of typing a secret. Nothing you type can be stolen, phished or reused. This guide explains passkeys in plain English, with no jargon left unexplained.
What is a passkey, in plain English?
A passkey is an authentication credential based on FIDO standards. Your device creates a pair of cryptographic keys when you set one up. The public key goes to the website. The private key stays on your device and never leaves it.
When you sign in with a passkey, you approve the login the same way you unlock your device. You use your fingerprint, face scan, PIN or pattern. There is no password to remember, type or reset. Your biometric data stays on the device and is never sent to the website.
The technology is built on the FIDO2 standard, which combines WebAuthn and CTAP. WebAuthn is the browser API that manages these credentials. Apple, Google and Microsoft all support passkeys.
How the sign-in works, step by step
Think of a passkey like a wax seal. Everyone can be given a picture of your seal to check against, but only you own the stamp. Each login hands you a fresh sheet to stamp, so an old stamped sheet is useless.
- You create a passkey for a website. Your device generates a key pair and sends the public key to the site.
- When you sign in, the site sends your device a challenge. The challenge is a large random value.
- Your browser passes the request to your device, along with the identity of the site asking.
- You approve it with your fingerprint, face, PIN or pattern.
- Your private key signs the challenge, and the signature goes back to the site.
- The site verifies the signature with the public key it already has. It also checks that the challenge matches the one it issued, and that the request was for the correct site.
Nothing secret crosses the network at any point. A phishing site cannot steal a passkey, because the signature is bound to the exact domain that requested it. A fake login page at a lookalike domain cannot trick your device into signing a challenge meant for the real site.
Passwords vs passkeys: the key differences
A password is a shared secret. You type it, send it to the website, and the website stores a copy. A passkey never shares its secret half at all. That single difference removes most of the ways passwords fail.
| Password | Passkey | |
|---|---|---|
| What you do | Remember or store it, then type it | Approve with fingerprint, face, PIN or pattern |
| What the site stores | Your password, usually hashed | Only your public key |
| Phishing risk | High: a fake page can capture what you type | Very low: signatures are bound to the real domain |
| Breach risk | High: stolen passwords can be reused | Low: a stolen public key is useless on its own |
| Reuse risk | High: people reuse passwords across sites | None: each site gets its own key pair |
| Speed | Slower, often with a second verification code | Faster: Amazon reports sign-ins up to six times faster, according to figures published by the FIDO Alliance |
Passwords sit behind most breaches. The FIDO Alliance notes that passwords are responsible for about 80% of breaches today. Removing the shared secret leaves attackers with nothing to steal from a database and reuse.
Synced vs device-bound passkeys
Synced passkeys live in a cloud-backed keychain, such as iCloud Keychain, Google Password Manager or Microsoft Password Manager. They copy themselves across every device signed into that account. Lose your phone and they are still there on your next device.
Device-bound passkeys never leave the physical hardware that created them. They usually live on a USB security key. They cannot be copied or synced, which makes them stronger against account takeover, but you need the key itself to sign in.
For most people, synced passkeys are the right choice. They are convenient and they survive a lost phone. Device-bound passkeys suit high-value accounts, such as a work admin account, where the extra friction is worth it.
How to start using passkeys
Most major services already support passkeys, including Google, Apple and Microsoft. Microsoft's own guide walks through creating one from your account's Advanced Security Options page. Getting started takes a few minutes per account.
- Check your device is up to date. You need a recent version of your operating system and browser. Google lists Chrome 109, Safari 16, Edge 109 and Firefox 122 as the minimum browser versions.
- Open the security settings of an account you use often, such as your Google or Microsoft account.
- Look for the passwordless sign-in option and choose to create one.
- Approve the creation with your fingerprint, face, PIN or pattern.
- Repeat for your other important accounts, starting with email. Your email account protects password resets everywhere else.
- Keep a backup sign-in method, such as a recovery code or a second device, in case you lose access to your provider.
Google notes that a newly created passkey may take up to seven days before it is available at sign-in. Only create one on a device you personally own. Start with one account and try signing in a few times. The flow feels strange the first time and normal by the third.
What to watch out for
If all your passkeys live in one provider's keychain, that provider becomes a single point of failure. Keep your account recovery options up to date, and know how to recover the keychain itself.
Not every site supports passkeys yet. Some sites offer them only as a second factor, not as a full password replacement. A few older devices and browsers cannot use them at all. In those cases, keep a strong, unique password and turn on two-factor authentication.
They also do not fix a compromised device. If someone has your unlocked phone, they can approve sign-ins. A strong device lock and a short auto-lock time still matter.
Bottom line
In one sentence, a passkey is a password replacement that proves who you are without ever sharing a secret. Your private key stays on your device, the site keeps only the public key, and every login is a fresh signature bound to the real domain. That design kills phishing and password reuse in one move. Start with your email account, keep a recovery method ready, and add the method to your other important accounts over time.