What Are Passkeys? The Passwordless Login Standard Explained

If you have ever reused a password, typed one into a look-alike login page, or waited for a texted code that never came, you have met the problems passkeys are built to erase. Passwords are also expensive for the companies that store them: a single breached database can expose millions of credentials that were reused across other sites Wikipedia's overview of passkeys. A passkey is a passwordless login credential based on public-key cryptography: your device proves who you are with a fingerprint, a face scan, or a screen-lock PIN, and no secret ever travels across the network. Apple put passkeys in front of the public in 2022, and Google, Microsoft, and the FIDO Alliance have since pushed them as the standard replacement for passwords Google's 'end of the password' announcement. For everyday users, the pitch is simple — log in faster, and stop getting phished. The result is login that is both quicker for you and far harder for someone else to abuse.

What Is a Passkey?

A passkey is a digital credential tied to your account and to one specific website or app. Technically it is an implementation of WebAuthn, the W3C standard that the FIDO Alliance and W3C developed together under the FIDO2 project Wikipedia's overview of passkeysthe WebAuthn specification. Where a password is a shared secret that both you and the server know, a passkey splits the work: a public key sits on the server, and the private key stays on your device Apple's passkeys documentation. In day-to-day use, a passkey feels like a normal login — except the "something you know" (a password) is replaced by the "something you have plus something you are" (your device plus your face or fingerprint).

That split is the whole point. The server never stores anything secret about you, so there is nothing for an attacker to steal in a database breach Google's passkeys developer guide. The credential you use is bound to the exact origin where it was created, which is what later keeps it safe from phishing.

How Passkeys Work

When you create a passkey for a site, your device generates a key pair. The public key goes to the server; the private key is locked inside a platform authenticator built into your operating system — Apple Keychain on Apple devices, Windows Hello on Windows, or the Android credential store Apple's passkeys documentation. Those authenticators use hardware security features such as a secure enclave or TPM, so the private key is hard to extract even if the device is compromised. That hardware backing is also why passkeys survive ordinary malware that might log your keystrokes.

Registration is a one-time step you barely notice: the site asks your device to create a credential, your OS confirms you are present with a biometric or PIN, and the public key is sent back. From then on, signing in is just that confirmation again. You unlock the device, and the authenticator uses the private key to answer a challenge from the server Google's 'end of the password' announcement. Because the math happens locally and only a signed response leaves the device, there is no password to intercept and no code to relay Google's passkeys developer guide. The server checks that signature against the public key it stored at registration; if they line up, you are in — no shared secret ever crossed the wire. The challenge the server sends is random and single-use, so a recorded sign-in cannot be replayed later. That property, called replay protection, is built into the protocol rather than left to each app to invent.

Why Passkeys Are Phishing-Resistant

The single biggest win is resistance to phishing. A passkey only works on the website where it was registered, because the authenticator binds the credential to that origin. Imagine a cloned bank page at a look-alike domain: your password would happily go there, but your passkey will not, because the credential is locked to the real one. Google contrasts this with SMS one-time codes, which passkeys beat outright on resistance to online attacks Google's 'end of the password' announcement.

This matters even if you already use a password manager. Many managers will autofill a saved password on a convincing fake page, because they match on the page you are viewing. A passkey cannot be tricked that way, because the credential itself carries the allowed origin and the device enforces it. This is also why passkeys matter for anyone who has clicked the wrong link: traditional passwords and many two-factor codes can be captured on a fake page, while a passkey simply will not authenticate there. For a closer look at the redirects attackers rely on, our URL redirect checker exposes exactly the tricks passkeys neutralize.

Passkey vs. Password vs. 2FA

The terms get mixed up, so here is the plain distinction:

• Password — a shared secret you memorize and type. Easy to reuse, leak, and phish.
• SMS or app 2FA — a second step on top of a password. Better than a password alone, but codes can be intercepted or SIM-swapped.
• Passkey — replaces the password entirely with a device-held private key. No shared secret, nothing to steal in transit.

Passwords fail at scale for a dull reason: people reuse them, and one breached site hands attackers the keys to others. Passkeys break that chain because there is no shared secret to reuse. The leap is that passkeys remove the secret from the server's database and the network entirely Apple's passkeys documentation. OAuth, another protocol we cover in our OAuth playground, solves a different problem — delegated access between apps — and often still sits on top of a password login rather than replacing it.

Synced vs. Device-Bound Passkeys

There are two flavors. A synced passkey lives in a cloud-backed store such as iCloud Keychain or Google Password Manager, so it follows you across your phone, laptop, and tablet Apple's passkeys documentationGoogle's passkeys developer guide. A device-bound passkey stays on one piece of hardware, often a physical security key, and cannot be copied to another device Microsoft's passwordless sign-in docs.

Synced passkeys are convenient and cover most people. Device-bound passkeys suit high-security accounts where you want a credential that physically cannot leave a controlled machine. Knowing which one you created matters at setup time, because the recovery story is different for each, and enterprises often mandate device-bound keys for sensitive systems while letting staff sync lower-risk ones. One caveat: a synced passkey is easiest to use inside the ecosystem that stores it, so moving every account from one provider to another is not yet seamless.

Are Passkeys Perfect?

No, and it is worth saying so. Passkeys require a reasonably modern device and a platform that supports them, so very old hardware is left out. Synced passkeys also tie your access to one ecosystem's cloud account, which some users dislike. And because support is still rolling out, you will often keep a password as a fallback whether you want one or not. None of that undoes the core benefit — removing the replayable secret — but it explains why the password is not gone yet. For the near term, treat passkeys as the strong default rather than a total replacement: turn them on where available, keep a recovery method current, and reserve a hardware key for the accounts where a breach would hurt most.

What Happens If You Lose Your Device?

This is the question everyone asks, and it is the main trade-off of synced passkeys. Because a synced passkey is backed up to your cloud account, you can sign in from a replacement device once you regain access to that account Apple's passkeys support articleGoogle's passkeys help center. The passkey itself is not lost with the phone.

The catch is that your cloud account becomes the master key, so protecting it with its own strong factor matters. Device-bound passkeys have the opposite profile: lose the hardware and you need the backup method the service provided at enrollment Microsoft's passwordless sign-in docs. Most consumer rollouts pair a passkey with a recovery path precisely so a lost device is an inconvenience, not a lockout.

Who Supports Passkeys Today?

Adoption moved from promise to practice in the 2020s. Apple shipped passkeys in 2022, Google brought them to Chrome and Android, and Microsoft supports FIDO2 passwordless sign-in across its identity platform Microsoft's passwordless sign-in docsthe passkeys.com adoption hub. The shift is sometimes called the beginning of the end of the password, and the three largest platform makers aligned on one standard rather than each building a walled garden. The alignment dates to a 2022 commitment by Apple, Google, and Microsoft, working with the FIDO Alliance, to make passwordless sign-in common across platforms. The passkeys.com hub tracks the growing list of services that let you skip the password the passkeys.com adoption hub.

In practice you will find passkeys at major email providers, password managers, and an expanding set of consumer apps. Support is not yet universal, so most accounts still offer a passkey as an option alongside — not strictly instead of — older methods, at least for now.

How to Start Using Passkeys

You do not need new hardware to begin; a recent phone or laptop already has the authenticator built in.

1. Turn it on where offered — when a site invites you to create a passkey, accept, and let your device generate it Google's passkeys help center.
2. Use your platform store — on Apple, passkeys save to iCloud Keychain; on Android and Chrome, to Google Password Manager, so they sync automatically Apple's passkeys documentation.
3. Keep a recovery path — note the backup method the service gives you in case you lose the device Apple's passkeys support article.
4. Prefer passkeys over SMS codes — when a service offers both, choose the passkey; it removes the phishing surface Google's 'end of the password' announcement.
5. Keep your OS updated — authenticator behavior improves with platform updates, and current software reduces edge-case failures.

Start with one or two accounts, get comfortable with the biometric prompt, then expand. If you manage a team, consider a hardware security key for shared or admin accounts, since device-bound passkeys are harder to lose to a single compromised phone. Each passkey you add is one fewer password that can leak.

Related Tools & Further Reading

• OAuth 2.0 Playground — OAuth delegates access between apps; passkeys replace the password itself. This ToolSura demo shows how the two fit different jobs.
• URL Redirect Checker — passkeys defeat phishing by binding to the origin; this tool exposes the redirects attackers rely on.
• SSL Checker — passkeys handle identity; TLS still protects the channel. Confirm your sites use solid certificates.
• Privacy Policy Generator — going passwordless changes what you store about users; keep your policy honest.