What is a passkey, and is it safer than a password?

How does a passkey work?

A passkey is built on an open standard from the FIDO Alliance, an industry body. When you create one, your device makes a pair of linked digital keys:

• a private key, which stays with you on your device or in your password manager and is never sent to the website
• a public key, which the website keeps

When you sign in, the website asks your device to prove it holds the private key. Your device checks it's you, using the same method you use to unlock it, and then answers. The FIDO Alliance explains that the website only learns that the check succeeded. It never receives your fingerprint, face scan or the private key.

The NCSC says passkeys are created and managed for you by your devices, so you don't have to create or remember anything.

Is a passkey safer than a password?

Yes, according to the NCSC. Its guidance says passkeys are always as secure as, or more secure than, a strong password with two-step verification. The main reasons:

• They resist phishing. The FIDO Alliance explains that the website you're signing in to can't be spoofed, so a fake login page can't collect your passkey.
• There's nothing to reuse. Apple notes passkeys are generated separately for every account by your own device.
• There's no shared secret for the website to lose. Apple explains that no shared secret is sent when you sign in, and the website doesn't need to protect the public key it holds.

Where a site doesn't offer passkeys yet, the NCSC's advice is still a strong, unique password with two-step verification.

Where are passkeys stored?

In your device's password manager, which the NCSC calls a credential manager. It creates the passkeys, protects them, backs them up and syncs them to your other trusted devices.

• iPhone, iPad and Mac: passkeys are saved in the Passwords app and stored in iCloud Keychain. Apple says iCloud Keychain is end-to-end encrypted with keys Apple doesn't know, and that to use passkeys you need iCloud Keychain and two-factor authentication turned on.
• Android: Google says passkeys on Android devices are registered in your Google Account automatically, through Google Password Manager.
• Windows: Microsoft says a passkey can be saved on your Windows device using Windows Hello, in Microsoft Password Manager or another synced password manager, on your phone, or on a physical security key.
• Standalone password managers: some store passkeys too. Proton Pass says passkeys are supported on all devices, including on its free plan. NordPass says you can store passkeys on any device with any plan.

The FIDO Alliance calls passkeys that sync between your devices "synced passkeys", and ones that never leave a single device, such as those on a security key, "device-bound passkeys".

What happens if I lose my phone?

Because synced passkeys are backed up, the NCSC says you shouldn't completely lose access to them if you lose a device. Synced passkeys follow the account, not the phone: Apple, for example, says passkeys work on all your devices where you're signed in to the same Apple Account.

You should also remove the passkey tied to the lost device. For a Google Account, Google says to sign in from another device, go to Security & sign-in, find the passkey under Passkeys and security keys and choose Remove.

The one thing to protect above all is the account that holds your passkeys, whether that's your Apple Account, Google Account or password manager. Give it a strong password and two-step verification.

Can I use a passkey on someone else's computer?

Yes, if you have your phone with you. The FIDO Alliance describes this as cross-device sign-in: the computer shows a QR code, you scan it with your phone, and your phone completes the sign-in. Apple's instructions say to enter your user name on the other device, choose an option such as Passkey from nearby device, and scan the QR code that appears.

How do I set up a passkey?

Check the security or sign-in settings of an account you already have, or look for a passkey option when you create a new one. If you don't see one, the site doesn't support passkeys yet.

For a Google Account

1. Go to myaccount.google.com/signinoptions/passkeys.
2. Select Create a passkey and follow the prompts to unlock your device.

Google says creating a passkey opts you in to signing in without a password where possible. You can still use your password: turn off Skip password when possible in your security settings.

For a Microsoft account

1. Sign in to Advanced security options at account.live.com/proofs/manage.
2. Choose Add a new way to sign in or verify.
3. Select Face, Fingerprint, PIN, or Security Key and follow the instructions on your device.

For websites and apps on iPhone

1. Sign in to the website or app, then go to its account settings.
2. When you see the option to save a passkey, tap Continue.
3. Next time, tap your account name on the sign-in screen and use Face ID, Touch ID or your passcode.

Apple notes you can keep both a passkey and a password for the same account, and find them together in the Passwords app.

Do I still need a password manager?

Yes, for now. Many accounts don't offer passkeys yet, so you'll still have passwords to manage, and your password manager is usually where your passkeys live too. If you use a mix of devices, such as an iPhone and a Windows laptop, a standalone password manager can keep everything in one place. See are password managers safe? and our guide on how to choose a password manager.

For the passwords you still have, our Password Check shows how hard one is to guess, and runs entirely on your device.

Common questions

Can a passkey be hacked or phished?

The FIDO Alliance says the website you sign in to can't be spoofed, so a fake login page can't capture a passkey, and the website never receives the private key that proves it's you. The National Cyber Security Centre says passkeys resist phishing because they can't be intercepted, reused or stolen like passwords. The weak point is the account that stores your passkeys, so protect your Apple, Google, Microsoft or password manager account with a strong password and two-step verification.

Does the website get my fingerprint or face scan?

No. Your fingerprint, face or PIN only unlocks the passkey on your own device. The FIDO Alliance says the website only receives confirmation that the check succeeded, never your biometric data or your private key.

What if I lose my phone?

Synced passkeys are backed up to your Apple, Google or Microsoft account or to your password manager, so the National Cyber Security Centre says you shouldn't completely lose access if a device goes missing. Sign in to the same account on your replacement device, and remove the passkey linked to the lost device from your account's security settings.

Can I have a passkey and a password on the same account?

Often, yes. Apple says you can keep both for the same website or app, and Google lets you keep using your password by turning off Skip password when possible. Keeping a strong password with two-step verification as a backup is sensible while you get used to passkeys.

Sources

• Passkeys: what you need to know — National Cyber Security Centre (opens in a new tab)
• Passkeys — FIDO Alliance (opens in a new tab)
• About the security of passkeys — Apple Support (opens in a new tab)
• Use passkeys to sign in to websites and apps on iPhone — Apple Support (opens in a new tab)
• Sign in with a passkey instead of a password — Google Account Help (opens in a new tab)
• Create and save a passkey — Microsoft Support (opens in a new tab)
• Proton Pass plans and pricing — Proton (opens in a new tab)
• Passkeys — NordPass (opens in a new tab)

Last checked: 25 September 2026