Originally published on CodingCush.
A passkey is a new way to sign in that replaces your password with your face, your fingerprint or your phone PIN. Instead of typing a password that can be stolen, guessed or reused by mistake, your device proves it is you with a digital key that never leaves your control. Google, Apple, Microsoft and Amazon now support passkeys, and setting one up takes about two minutes. This guide explains what a passkey is in simple words, how it keeps you safer than a password, and how to create one for your accounts today.
What Is a Passkey, in Simple Words?
Think of a passkey like a house key and lock pair. When you create a passkey for a website, your phone or computer makes two matching keys. One key, called the public key, is given to the website to store, like a lock fitted to a door. The other key, called the private key, stays locked inside your device and is never shared with anyone.
When you sign in, the website checks that your device holds the matching private key. You approve the check with Face ID, a fingerprint or your device PIN, the same actions you already use to unlock your phone. Nothing secret travels across the internet, and there is no password for you to remember, type or accidentally hand to a fake website.
The official Google passkeys page puts it simply: passkeys are a simpler and safer alternative to passwords. They are built on a shared standard created by the FIDO Alliance and the World Wide Web Consortium, which is why the same idea works across Google, Apple, Microsoft and hundreds of apps and websites.
Why Passkeys Are Safer Than Passwords
- They cannot be phished. A passkey only works on the real website it was created for. A fake look alike page cannot trick your device into using it, because the key is tied to the genuine web address.
- They cannot leak in a data breach. The website only stores the public key, which is useless on its own. Hackers who steal a company's database get locks, not keys.
- There is nothing to reuse. Every passkey is unique to one account. The common habit of using one password everywhere, which our guide on how to create a strong password warns about, simply disappears.
- There is nothing to forget. Your passkeys sync through your Google account or iCloud Keychain, so a new phone can restore them after you sign in.
- They are faster. Google reports that signing in with a passkey is noticeably quicker than typing a password and then waiting for a text code.
Google's official passkeys page, explaining how passkeys replace passwords (Source: google.com)
How to Create a Passkey for Your Google Account
- On your phone or computer, open your browser and go to myaccount.google.com.
- Open the Security section and look for the passkey option under how you sign in to Google.
- Choose "Create a passkey" and confirm with your fingerprint, face or device PIN.
- That is it. Next time you sign in to Google on that device, you will approve the sign in instead of typing a password.
On an Android phone, a passkey is often created automatically for your Google account, because the phone itself holds the key. On Windows, your passkey can be stored in Windows Hello. On iPhone, iPad and Mac, passkeys live in iCloud Keychain, and the Apple support guide to passkeys shows the exact steps for each Apple device.
How to Use a Passkey on Another Device
Sometimes you need to sign in on a device that does not hold your passkey, like a work computer or a friend's laptop. Choose the passkey option on the sign in page, and the site will show a QR code. Scan it with your phone, approve with your face or fingerprint, and you are in. Your phone must have Bluetooth on, because the two devices confirm they are physically close. This stops a scammer on the other side of the world from using a screenshot of your QR code.
Passkeys and Two Factor Authentication: Do You Still Need Both?
A passkey already contains two factors in one step: something you have, your device, and something you are or know, your face, fingerprint or PIN. For accounts that still use a password, keep two factor authentication switched on, because it blocks most account takeovers even when a password leaks. Our explainer on what two factor authentication is and why you need it shows how to set it up on your main accounts. The sensible plan for 2026 is simple: use a passkey wherever it is offered, and keep two factor protection on everything else.
What If You Lose Your Phone?
This is the question everyone asks first, and it has a calm answer. Your passkeys are backed up in your Google account or iCloud account, so signing in to a new phone restores them. For the short gap, every major service still offers recovery options, such as a backup email, a trusted device or recovery codes you saved in advance. Save those recovery codes somewhere safe when you set up your account, ideally printed and kept at home. Losing a phone is a bad day. With passkeys and recovery codes, it does not become a locked out of everything day.
Which Websites and Apps Support Passkeys?
Support is growing fast. Google, Apple, Microsoft, Amazon, PayPal, WhatsApp, TikTok, eBay, Adobe and many banks already offer passkeys, and the list grows every month. When a site offers "Create a passkey" in its security settings, take the offer. It is the rare security upgrade that also makes your daily life easier, because signing in becomes one glance or one touch.
Your 10 Minute Passkey Setup Plan
You do not need a free afternoon for this. Pour a tea or coffee and work through this short list:
- Start with your email account. Your inbox is the master key to everything else, because password resets land there. Create a passkey for Google or Apple mail first.
- Add your money accounts. Create passkeys for your bank, PayPal and any payment apps that offer them.
- Protect your shopping and social accounts. Amazon, eBay, WhatsApp and TikTok all support passkeys now.
- Save your recovery codes. Each service offers backup codes during setup. Print them or store them in your password manager.
- Test a sign in. Sign out once and come back in with the passkey, so your first real use is not during a stressful moment.
That is the whole upgrade. Ten minutes of setup buys you faster sign ins and stronger protection on the accounts that matter most, every single day.
Frequently Asked Questions
Is a passkey the same as my phone unlock PIN?
Not exactly. You use your PIN, face or fingerprint to approve the passkey, but the PIN itself never leaves your device and is never sent to the website. The website only receives proof that the approval happened.
Can I still use my password after creating a passkey?
On most services, yes. The password stays as a backup sign in method until you choose to remove it. The passkey simply becomes the faster, safer option you use every day.
Do passkeys work on older phones?
Passkeys need a reasonably recent system: iOS 16 or later on iPhone, Android 9 or later with Google Play services, and current versions of Chrome, Safari or Edge. If your device can receive security updates, it can almost certainly use passkeys.
What happens if a website does not offer passkeys yet?
Use a strong, unique password from a password manager and switch on two factor authentication. Then check the site's security settings every few months, because new services add passkey support all the time.
Final Thoughts
Passwords had a good run of about sixty years, but they fail in ways passkeys simply cannot. A passkey cannot be guessed, reused, phished or leaked from a company's database, and using one feels like unlocking your phone, because that is exactly what it is. Spend ten minutes today creating passkeys for your Google, Apple or Microsoft account and your email. It is the simplest security upgrade most people in the USA and the UK can make this year.
