What are passkeys and should I use them?

Passwords fail in two ways that cannot be fixed by making them longer: they can be phished, and they can be stolen in bulk from whoever you gave them to. Passkeys are the industry's answer, and they address both by never sending a secret at all.

Safety

Step by step

1. Understand what is actually stored.Your device generates a pair of keys. The website keeps the public one, which is useless on its own. The private one never leaves your device. There is no shared secret, which is the whole point.
2. See why phishing stops working.A passkey is bound to the real website's domain. A convincing fake at a slightly different address simply does not have a passkey to offer — the browser will not produce one. It is not that you notice the fake; it is that it cannot work.
3. See why breaches matter less.A site that is breached leaks public keys, which cannot be used to sign in. Compare that with a password database, where a leak is directly usable against every site where you reused the password.
4. Know what unlocks it.Your fingerprint, face or device PIN. That biometric never leaves the device and is not sent to the website — it only unlocks the key locally. This is the part people most often misunderstand.
5. Understand where passkeys live.In the device's secure store, and usually synced across your devices through iCloud Keychain, Google Password Manager or a third-party password manager. That sync is what stops a lost phone becoming a lockout.
6. Set them up on your most valuable accounts first.Email above everything, since it is the reset route for everything else. Then banking, cloud storage and anything with payment details attached.
7. Keep a recovery route.A second device with the same passkey, recovery codes written down and stored physically, or the password retained as a fallback. Most services keep the password alongside for now, which is a reasonable safety net.
8. Expect a mixed experience for a while.Support is uneven. Some sites offer passkeys, some do not, and some implement them awkwardly. You will be running both systems for a few years.
9. Use a password manager that syncs them.It makes passkeys work across platforms rather than locking them to one ecosystem — which is the practical complaint people have after switching.
10. Understand what happens on a shared computer.You can usually sign in by scanning a code with your phone, which holds the passkey. Nothing is left on the shared machine, which is better than typing a password into it.
11. Do not delete the password too eagerly.Until you are confident in the recovery path for a given account, keeping the password as a fallback costs nothing. Removing it is the step to take last.

Tips

• If you already use a password manager with strong unique passwords and two-factor, passkeys are an improvement rather than a rescue. Start with them anyway on email.
• Passkeys and two-factor are not separate steps — the passkey is both something you have and something you are, so most sites drop the second prompt.
• Adding a passkey does not usually remove the password. You can try one account and see how it feels before committing.

Common mistakes

• Switching an account to passkey-only with one device — Losing or breaking that device with no synced copy and no recovery code can mean losing the account entirely. Set up recovery first.
• Assuming your fingerprint is sent to the website — It is not. The biometric only unlocks the key locally on your device — nothing biometric is transmitted or stored by the site.

If it doesn't work

Questions people ask