You go to sign in to a website. Instead of asking for a password, it offers to use your face, fingerprint or phone's PIN. No password to remember, no six-digit code to copy from a text message. That's a passkey.
It sounds almost suspiciously convenient. But passkeys are designed to be safer than passwords, too. The clever bit is that the website never needs to know a secret that you could accidentally type into a fake login page.
So where's the password gone?
When you create a passkey, your device generates two matching digital keys. One stays private in your passkey manager. The website gets the other, public key.
Think of it like a lock and its matching key. The website can check that your device has the right key without receiving a copy of it.
When you return, your phone or computer asks you to unlock it with Face ID, Touch ID, a fingerprint or your device PIN. It then uses the private key to prove you're you. Your fingerprint or face scan isn't sent to the website. Google's explanation of passkeys describes how this works.
And unlike a password, a passkey is tied to the real website or app. A convincing fake sign-in page can't simply trick your browser into using it for the wrong site. That's why the passkeys.dev guide calls them phishing-resistant.
What if you lose your phone?
This is the obvious question. Fortunately, a passkey doesn't always live on just one physical device.
On Apple devices, passkeys saved in iCloud Keychain can sync securely between your approved iPhone, iPad and Mac devices. Apple says the synced data is end-to-end encrypted. Google Password Manager offers passkey syncing too, although the exact devices and browsers supported depend on your setup.
You can also sometimes sign in on a computer using a passkey stored on your phone. Choose the nearby-device option, scan the QR code shown on the computer, then approve the sign-in on your phone. Google documents this cross-device approach.
Still, don't assume every account has an identical recovery process. Before relying on passkeys alone, check how your passkey manager restores access on a new device and what backup sign-in or recovery options the website provides.
Should you use one?
If a website you trust offers to create a passkey, it's generally worth considering. You can often keep your existing password while you try it, so switching doesn't have to be dramatic.
On an iPhone, Apple's instructions say to sign in to a supported website or app, find its passkey option and approve saving it. The result appears in the Passwords app. The next time you sign in, you can use Face ID or your device passcode instead.
Passkeys won't instantly replace every password. Some services still don't support them, and recovery deserves a little thought. But removing the need to invent, remember and type a reusable secret is a genuinely useful improvement.
One less password to forget. That's a good start.
Sources
Every fact in this article comes from one of these.