What is a passkey? Signing in with your face or fingerprint instead of a password

If your phone or a website has just asked whether you’d like to “create a passkey”, this explains what that means before you tap anything. A passkey is a way of signing in with your face, your fingerprint or your phone’s screen lock instead of typing a password, and Apple, Google and Microsoft all now offer it. It is safe to say yes on your own phone, and it is safe to say “not now” too. If you’d like someone beside you while you set it up, we offer help setting up passkeys on your own phone and accounts.

What is a passkey?

A passkey is a sign-in that replaces your password. Microsoft’s own description is the plainest: passkeys are a replacement for your password. Apple puts it as a way to sign in to a website or an app without needing to create and remember a password.

Think of it as a key and a lock that are made as a pair. When you set up a passkey, your phone or computer makes two matching keys for that one account. Apple explains that the website keeps one of them, the public half, and your device keeps the other, the private half. The private half is never sent to the website, so there is no secret sitting on the website’s computers for anyone to steal.

To use the key, you unlock your device the way you already do: Face ID or Touch ID on an iPhone, iPad or Mac, a fingerprint, face or screen lock PIN on an Android phone, or Windows Hello on a Windows computer. Google and Microsoft both say your fingerprint and face data stay on your device and are never shared with them.

How does signing in with a passkey work?

You go to the website, choose your account, and your phone asks you to unlock it. That’s it. Your device answers the website with its half of the key, the website checks it against its half, and you’re in. Nothing is typed, so there is nothing to mistype or forget.

What's happening?

Signing in with a passkey A fake website asks A new phone

Windows Hello only

Signing in with a passkey

The website asks your phone for its passkey. You unlock the phone with your face, your fingerprint or its screen lock, the phone answers, and the website lets you in. Your face or fingerprint never leaves the phone.

A fake website asks

A copy of the real website asks for your passkey. The passkey was made for the real website only, and your phone and browser won't use it anywhere else, so the fake site gets nothing. There's no password to type in, so there's nothing for it to steal.

A new phone

Sign in to the new phone with the same Apple Account or Google Account, and the passkeys saved there come across with it. A passkey saved only on one computer, in Windows Hello, doesn't come across.

What happens to a passkey in three everyday cases

What's happening	What the passkey does
Signing in with a passkey	The website asks your phone for its passkey. You unlock the phone with your face, your fingerprint or its screen lock, the phone answers, and the website lets you in. Your face or fingerprint never leaves the phone.
A fake website asks	A copy of the real website asks for your passkey. The passkey was made for the real website only, and your phone and browser won't use it anywhere else, so the fake site gets nothing. There's no password to type in, so there's nothing for it to steal.
A new phone	Sign in to the new phone with the same Apple Account or Google Account, and the passkeys saved there come across with it. A passkey saved only on one computer, in Windows Hello, doesn't come across.

Can I use the passkey on my phone to sign in on a computer?

Yes, if the two are near each other. On the computer, choose the option to use a passkey from another device, and a QR code appears on its screen. Scan it with your phone’s camera, unlock the phone, and the computer signs in. Microsoft says both need Bluetooth on and an internet connection, and Google says the passkey stays on your phone. On a Mac, Apple calls the option “Passkey from nearby device”, under Other Options.

Why can’t a fake website use your passkey?

Because each passkey only works on the website it was made for, and your phone and browser check that, not you. Google’s own explanation for developers (opens in a new tab) is that passkeys are bound to a website or app’s identity, and that the browser and operating system make sure a passkey can only be used with the website or app that created it. Microsoft says the same: passkeys are enforced by the browser or operating system to be used only for the right service, “rather than relying on human verification”.

That last part is the point. A scam text or email works by sending you to a copy of a real website that looks exactly right, then asking you to type your password into it. With a password, the copy gets it. With a passkey, there is nothing to type, and your phone won’t hand the copy a key that was made for the real website. Apple, on its page about the security of passkeys (opens in a new tab), sums it up as resistant to phishing, always strong, and designed so that there are no shared secrets.

A passkey protects the sign-in. It doesn’t make a scam message safe to act on. Scammers also ask for one-time codes, card details, or for you to install an app so they can see your screen, and Scamwatch’s advice is never to share passwords or one-time codes. It also says that if someone asks you to download software onto your device, it’s a scam. How to check a text, email or website without clicking it goes through the signs.

How do I set up a passkey?

On a website or app that offers passkeys, look for “Create a passkey” or “Save a passkey” when you sign in or in the account’s security settings, then unlock your device when asked. Not every website offers passkeys yet. Before you start, make sure your phone has a screen lock (a PIN, a fingerprint or face unlock), because Google and Apple both use it to protect your passkeys. Here are the three big accounts, each from its own maker’s steps.

With your Apple Account, on an iPhone, iPad or Mac

On Apple devices, your passkeys are kept in the Passwords app and synced with your Apple Account through iCloud Keychain. Apple’s Mac guide says iCloud Keychain must be set up to create a passkey, and Apple says an Apple Account using iCloud Keychain needs two-factor authentication. Then Apple’s steps are:

1. 1

   Start on the website or app

   Tap the button or link for setting up a new account, or sign in to your existing account and go to its settings.

2. 2

   Save the passkey

   When you see the option to save a passkey for the account, tap Continue.

3. 3

   Confirm it's you

   Use Face ID or Touch ID when asked. On a Mac with Touch ID, place your finger on the sensor.

4. 4

   Find it later

   The passkey is saved in the Passwords app, and Apple says it's available on all your devices signed in to the same Apple Account.

If no passkey option appears, Apple says the website or app doesn’t support passkeys yet. Your password still works as before.

For your Google Account

Google’s steps work on an Android phone, an iPhone or a computer:

1. 1

   Open the passkeys page

   Go to myaccount.google.com/signinoptions/passkeys and sign in to your Google Account.

2. 2

   Create the passkey

   Tap Create a passkey, then Create a passkey again.

3. 3

   Unlock your device

   Unlock your phone or computer the way you normally do, with your fingerprint, face or screen lock.

On an Android phone signed in to your Google Account, Google says you may already have passkeys made for you automatically. Google’s one warning is worth repeating: only create passkeys on devices you personally own and use, never a shared one, because anyone who can unlock your device can get into your Google Account. The full steps are on Google’s page to sign in with a passkey instead of a password (opens in a new tab).

For your Microsoft account

Do this on the phone or computer where you want the passkey saved. Microsoft’s steps are:

1. 1

   Open Advanced security options

   Sign in to your Microsoft account's Advanced security options at account.live.com/proofs/manage.

2. 2

   Add a way to sign in

   Choose Add a new way to sign in or verify, then Face, fingerprint, PIN, or security key.

3. 3

   Follow your device

   Follow the instructions on the screen. Choose Continue or Create to save the passkey in the place your device suggests, or Change or Save another way to pick somewhere else.

4. 4

   Name it

   Give the passkey a name, such as the phone or computer it's on, so you can tell it apart later.

Next time you sign in, choose Sign-in options or Other ways to sign in, then Face, fingerprint, PIN, or security key. Microsoft’s page to create and save a passkey (opens in a new tab) lists where a passkey can be saved: a password manager, an iPhone, iPad or Android phone, Windows Hello, or a security key.

A security key is a small physical key, bought separately, that can hold a passkey instead of your phone. You don’t need one to use passkeys; your phone or computer does the job.

What happens if I lose my phone or get a new one?

A new phone gets your passkeys back when you sign in with the same account; a lost phone’s passkey should be removed from your account. Where the passkey was saved decides which, so it’s worth knowing.

• Apple Account. Apple says each passkey is stored in iCloud Keychain and is available on every device signed in to the same Apple Account. If you have no Apple device left to bring them across, Apple says they can be recovered from iCloud Keychain with your Apple Account details, a text message to your registered phone number and your device passcode.
• Google Account. Google says passkeys in Google Password Manager are backed up and synced to your Google Account, protected by your Android phone’s screen lock or a Google Password Manager PIN. A new phone may ask for one of them.
• Windows Hello. Google’s Chrome help notes that a passkey saved only in Windows Hello on one computer isn’t synced or backed up. If that computer goes, the passkey goes with it, and you sign in another way.

If a phone is lost or stolen, Google’s advice is to sign in to your Google Account on another device and remove that phone’s passkey: under How you sign in to Google, open Passkeys and security keys, choose the passkey and tap Remove. For a Microsoft account, Microsoft’s page shows the passkey under Ways to prove who you are, with Remove beside it.

If you can’t get into the account at all, what to do when you’re locked out of an Apple Account or Microsoft account takes you through the makers’ own recovery steps. If you think someone else has got in, start with what to do if you think you’ve been hacked.

Can I keep my password as well?

Yes, in most cases. Google says adding a passkey to your Google Account doesn’t change or remove any of your other sign-in or recovery methods, and you can turn off “Skip password when possible” if you’d rather type the password first. Microsoft treats removing the password as a separate step, the Passwordless account setting, which you can turn on and turn off again. When Microsoft Edge makes a passkey for a website automatically, Microsoft says your existing sign-in details stay as they are.

Other websites differ, so look in the website’s own account settings before you remove a password. Either way, keep a strong password and an up-to-date recovery phone number on your main accounts, because they are the way back in if every device is lost.

The passkeys and passwords on your phone live in the same place, the Passwords app on an iPhone or Google Password Manager on Android. The password manager already on your phone shows how to find them, see what’s saved and tidy it up.

Should I say yes when it asks to create a passkey?

On your own phone or computer, yes, it’s a sensible step. It’s one less password to remember, and it’s the one kind of sign-in a fake website can’t take from you. Say “not now” on a shared or borrowed device, a library computer, or anyone else’s phone.

Three things make it go smoothly:

• A screen lock on the phone. A PIN, a fingerprint or face unlock. Without one, the phone can’t protect a passkey.
• Signed in to your Apple Account or Google Account. That’s what brings your passkeys across to a new phone.
• Bluetooth on, if you’ll use the phone to sign in on a computer.

When to call us, and when you don’t need to

You don’t need us to make a passkey. If the website offers one and your phone has a screen lock, it takes a minute and it’s yours to do. If a website won’t let you make one, that’s the website’s choice, not a fault, and your password still works.

Call us when:

• You’re not sure which accounts you have, or which email address each one uses.
• The phone asks for a code sent to an old number, or a password nobody remembers setting.
• You’re moving to a new phone and want to be sure the passkeys and passwords come across.
• You’d rather someone sat beside you while you set it up for a parent or for yourself.

A home tech support visit to sort out passwords and accounts is made for this. We come to you, work on the phone or computer in front of both of us, and you type your own passwords; we never sign in as you. We don’t do remote support, and we can’t get into an account for you when its maker’s recovery steps fail, but we’ll go through those steps with you and leave the recovery details up to date. A visit is setup and help, with no hardware repair or data recovery.

Not sure it’s worth a visit? Send us a message saying which phone and which accounts, or ring 02 9188 1577.