Passkeys Explained

What a passkey actually is

A passkey is a digital credential stored on your device (or in a credential manager) and unlocked with your fingerprint, face, or device PIN. When you create a passkey for a website, your device generates a pair of cryptographic keys: a private key that is never shared with the website, and a public key stored on the website's server. When you log in, the website sends a cryptographic challenge to your device. Your device solves it using the private key — but only after you authenticate locally with your fingerprint or face. No password is typed or transmitted.

The fundamental difference from a password: a password is a shared secret — both you and the website know it. A passkey has no shared secret. The website only has a public key, which is mathematically useless without the corresponding private key, which the website never sees.

How passkeys work under the hood: FIDO2 and WebAuthn

Passkeys are built on two open standards: FIDO2 (developed by the FIDO Alliance, which includes Apple, Google, Microsoft, Amazon, and hundreds of other organisations) and WebAuthn (a W3C web standard implemented by all major browsers). When you log in: the site sends a random challenge. Your browser asks your OS to handle it. Your OS identifies which passkey to use, confirms your biometric or PIN, signs the challenge with your private key, and sends the signature back. The site verifies it with your public key. If valid, you are logged in — within seconds, with no password typed.

Phishing resistance is architectural. The website's domain is included in the data being signed. A fake website at a different domain cannot receive a valid signature — the private key will not sign authentication requests for domains it was not enrolled for. A phishing site that captures your passkey response has a signature that is only valid for the domain the passkey was created for — not the attacker's domain.

Passkeys vs passwords: the security comparison

Passwords can be guessed through brute force if too short. Passkeys have no guessable component — the private key is a randomly generated cryptographic key (typically an elliptic-curve key of 256 bits) that no brute force can approach. Passwords can be phished — you type them into a fake site. Passkeys are designed to resist phishing. Passwords can be stolen in a server breach if the site stores them poorly. Passkeys cannot — the server only has a public key, which is worthless to an attacker. The private key is never sent to the website.

Which platforms and sites support passkeys in 2026

Operating system support: iOS 16+, Android 9+, macOS Ventura+, Windows 11 (via Windows Hello; version 23H2 or later), all major browsers (Chrome, Safari, Firefox, Edge). Sync: passkeys sync through iCloud Keychain (Apple), Google Password Manager (Android/Chrome), or Microsoft Password Manager in Edge (Windows, since late 2025). Major services: Google, Apple ID, Microsoft, GitHub, PayPal, eBay, WhatsApp, Adobe, Shopify, Best Buy, Kayak, Nvidia, Yahoo, and hundreds more. The FIDO Alliance publishes a Passkeys Directory of implementations on its website, and passkeys.dev offers developer resources.

What happens if you lose your device

For Apple users: passkeys sync to iCloud Keychain. If you lose your iPhone, your passkeys are available on a new iPhone after signing into iCloud. For Google users: passkeys sync to Google Password Manager. Available immediately on a new Android device or Chrome browser after signing in. For cross-platform situations: you can use a phone as an authenticator for another device (cross-device authentication using a QR code and a Bluetooth proximity check). Hardware security keys (YubiKey) can also store passkeys and work across all platforms with no cloud sync required.

Should you switch to passkeys now

Yes, for every account that supports them. The login experience is faster — biometric authentication is typically near-instant. The security improvement is substantial — phishing, brute force, and server breach attacks are largely neutralised for passkey-protected accounts. The transition is additive: you do not need to delete your password when you add a passkey, so there is no single point of failure during the transition. The practical approach for 2026: enable passkeys on every account that supports them. Keep a password manager for accounts that do not yet support passkeys. The password manager and passkeys work alongside each other.