Stolen and misused credentials are still the most common way attackers get in. In Verizon’s 2025 Data Breach Investigations Report, credential abuse was the leading way into breached organisations for the second year running, ahead of software vulnerabilities and phishing. Meanwhile, most of us juggle dozens of logins, and that fatigue leads to risky habits like reusing the same password everywhere.

Passkeys fix this. Backed by Apple, Google and Microsoft, they replace passwords with cryptographic keys that can’t be guessed, reused or phished. There’s no secret to type, so there’s nothing for a hacker to steal. Here’s how they work, how they compare with what you use today, and how to set up your first one.

What Exactly Is a Passkey?

A passkey is a sign-in method built on standards from the FIDO Alliance, an industry group working to replace passwords. Each passkey is a pair of digital keys: a public key and a private key.

The website or app keeps only the public key. Your private key stays on your device, or in your password manager, and never leaves it. Even if a company’s servers are breached, there’s nothing there an attacker can use to sign in as you.

Think of it as a lock and key. The website has the lock (the public key), and only you hold the key that opens it (the private key).

How Passkeys Work (Without the Jargon)

  1. When you create a passkey, your device generates the key pair and sends only the public key to the website.
  2. When you sign in, the website sends your device a one-time challenge.
  3. You unlock your device with your face, fingerprint or PIN, the same way you unlock your phone.
  4. Your device signs the challenge with your private key and sends back the signature, which the website checks against your public key.

Your fingerprint or face scan never leaves your device, and neither does your private key. The whole thing takes a second or two, much like tapping your phone to pay.

Why Passkeys Stop Phishing

Phishing works by tricking you into typing your password on a fake website. Passkeys make that impossible: each passkey is tied to the real website’s address. If you land on a look-alike page, your device simply won’t offer the passkey, because the address doesn’t match.

You don’t have to spot the fake. The technology does it for you.

Passkeys vs. What You Use Today

Passkeys vs. passwords

Passwords are shared secrets. You know the password, and so does the website. That’s why they can be guessed, stolen in a data breach, captured by keyloggers or reused across sites by attackers.

Passkeys have none of those weaknesses. They’re unique to each website, generated by your device rather than chosen by you, and never typed, so there’s nothing to guess, reuse or overhear.

Passkeys vs. two-factor authentication (2FA)

Two-factor authentication adds a second step after your password, usually a code by text message or from an authenticator app. It’s a big improvement on a password alone, but it has gaps:

  • SMS codes can be stolen through SIM-swap fraud, where a criminal moves your phone number to their own SIM.
  • Any code you type can be captured by a convincing phishing page and used immediately.

A passkey already combines two factors: something you have (your device) and something you are or know (your face, fingerprint or PIN). And because it’s tied to the real website, a phishing page can’t capture it. It’s stronger than most 2FA, and faster too. The FIDO Alliance’s 2025 Passkey Index found that passkey sign-ins succeed 93% of the time, more than double the rate for other methods.

Where biometrics and authenticator apps fit

Your fingerprint or face scan isn’t the passkey itself. It’s what unlocks the passkey on your device. Think of biometrics as the doorman and the passkey as the key in the safe.

Authenticator apps that show six-digit codes are still worth using on accounts that don’t support passkeys yet. Where passkeys are available, they’re the better option.

Who Supports Passkeys?

Support is now built into every major platform:

  • Apple supports passkeys on iPhone, iPad and Mac, synced through iCloud Keychain.
  • Google supports them on Android and in Chrome, synced through Google Password Manager.
  • Microsoft supports them in Windows and Edge, and has made passkeys the default sign-in for new Microsoft accounts.
  • Password managers such as 1Password, Bitwarden and Dashlane can store and sync passkeys across platforms.

Thousands of services now offer passkey sign-in, including Google, Microsoft, Amazon, PayPal, eBay, GitHub and WhatsApp. The FIDO Alliance estimates that around 5 billion passkeys are now in use worldwide.

Syncing, Switching and Losing Your Phone

Passkeys saved in iCloud Keychain, Google Password Manager or a password manager are synced and backed up with end-to-end encryption. If you lose or replace your phone, sign in to your new one with your Apple or Google account, and your passkeys come with it.

Moving passkeys between ecosystems, say from Apple to a different password manager, is getting easier too. A new industry standard for securely exporting and importing passkeys is rolling out, and Apple added support for it in iOS 26.

One exception: passkeys stored on a physical security key (like a YubiKey) don’t sync. If you use one, register a second key as a backup.

How to Create Your First Passkey

What you need

  • A recent device: iOS 16 or later, Android 9 or later, Windows 10 or 11, or macOS Ventura or later.
  • An up-to-date browser: current versions of Chrome, Safari, Edge and Firefox all support passkeys.
  • A screen lock: turn on Face ID, a fingerprint or a PIN on your device.

Step by step

  1. Sign in to the account the usual way, and open its Security or Sign-in settings.
  2. Look for “Passkeys” or “Create a passkey”.
  3. Follow the prompt. Your device asks you to confirm with your face, fingerprint or PIN.
  4. Test it. Sign out, then sign back in using the passkey.

That’s it: usually under a minute. Start with your email account, since it’s the key to resetting everything else, then add passkeys to your banking, Microsoft or Google account, and any other service that offers them.

Tips for a smooth switch

  • Make sure syncing is on. On iPhone, check that iCloud Keychain is turned on under Settings > [your name] > iCloud. On Android, passkeys save to Google Password Manager automatically.
  • Keep a backup way in. Keep your account recovery options (a recovery email, phone number or recovery codes) up to date, and store recovery codes somewhere safe and offline.
  • Don’t delete your password straight away. Many services keep it as a fallback. Once you’re comfortable with passkeys, make that password long and unique, or remove it where the service allows.
  • Keep your devices updated. Passkeys are only as secure as the device holding them.

Passkeys for Your Business

Passkeys aren’t just for personal accounts. Microsoft 365 and Google Workspace both support passkeys for staff sign-ins, which protects your business email, files and admin accounts from the phishing attacks that so often start a breach. Rolling them out takes some planning: which accounts to start with, how staff recover access if they lose a phone, and what to do about shared devices.

If you’d like help setting up passkeys across your team, get in touch. We’ll recommend a plan that fits how your business works.

The End of Password Anxiety

Passkeys are faster than passwords, stronger than most 2FA, and they shut out phishing by design. With Apple, Google and Microsoft all on board, they’re here to stay.

Start today. Add a passkey to your email account, then work through the rest. Your online life gets safer and simpler, one sign-in at a time.