Cybersecurity

What Are Passkeys? How They Work

Passkeys are a replacement for passwords: instead of a secret you type, you sign in with a cryptographic key stored on your own device, unlocked by your fingerprint, face or PIN. They cannot be phished, cannot be guessed, and cannot be stolen in a data breach in a usable form. This guide explains how they work, why they are safer than passwords, and how to start using them.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

What a passkey is

A passkey is a pair of cryptographic keys that work together. The private key stays on your device — your phone, your computer, or a hardware security key — and never leaves it. The public key is given to the website when you create the passkey. When you sign in, the website sends your device a challenge, your device signs it with the private key, and the website verifies the signature with the public key. If the signature matches, you are in.

You never see the keys. You unlock the process with something you already use: your fingerprint, your face, or your device PIN. There is nothing to type, nothing to remember, and nothing an attacker can copy from a screen. A phishing site cannot capture a passkey, because the device checks which website it is talking to before it signs anything — a fake site simply fails the check.

Passkeys come in two forms. A device-bound passkey lives on one device, usually a hardware security key, and cannot be copied off it. A synced passkey is stored in a password manager or in your operating system's key store and synced across your devices, so you can sign in on your phone, your laptop, and your tablet with the same passkey.

How passkeys differ from passwords

The differences are best seen by attack. A password can be phished: a fake login page captures what you type. A passkey cannot be, because the device only signs challenges from the genuine website — a lookalike domain fails the check silently. A password can be guessed, or cracked from a stolen password file. A passkey cannot be guessed, and a stolen public key is useless without the private key that never left your device.

A password can be reused, and reuse is the cause of most password damage. A passkey is created for one website only, and it cannot be used on another — reuse is structurally impossible. A password can be forgotten; a passkey is unlocked by your fingerprint or face, which you carry with you. And a password can be reset by an attacker who controls your email; a passkey does not depend on your email at all.

None of this makes passwords disappear overnight. Most services still offer passwords as a fallback, and account recovery still matters. But every account you move to a passkey is an account that can no longer be taken over by the most common attacks.

How a passkey sign-in works, step by step

Creating a passkey takes seconds. On a website that supports them, you choose to create a passkey, usually under security or sign-in settings. Your device asks you to confirm with your fingerprint, face or PIN, and generates the key pair. The public key is sent to the website and tied to your account. The private key stays in your device's secure storage or your password manager.

Signing in is even simpler. You enter your username, or the site offers a passkey option directly, and your device prompts you to confirm with your fingerprint, face or PIN. Behind the scenes, the site sends a challenge, your device signs it, the site verifies the signature, and you are signed in — usually in under two seconds, with no password typed.

Because the challenge is unique each time, and because it is bound to the genuine website's address, the signature cannot be replayed on another site. Even if an attacker recorded the whole exchange, it would be useless for a second login. That is the property that makes passkeys phishing-resistant, and it is the reason security standards now treat them as the strongest common way to sign in.

Synced vs device-bound passkeys

Synced passkeys live in a password manager or your device's key store and are copied securely between your devices — for example, between your phone and your laptop through your platform's account. They are convenient, because losing one device does not mean losing access, and they are the form most people will use. NIST SP 800-63B Revision 4 recognises synced passkeys at Authenticator Assurance Level 2.

Device-bound passkeys live on one physical device, typically a hardware security key, and cannot be copied off it. They are the stronger form, because the key cannot leave the device at all, and NIST recognises them at Level 3, the highest assurance level. They are the right choice for high-value accounts: administrator accounts, financial accounts, and anything where a compromise would be serious.

The trade-off is recovery. If you lose the only device holding a device-bound passkey, and you have no other way in, you can be locked out — which is why services that offer device-bound passkeys also require a recovery method, usually a second passkey on another device or a registered backup. Keep at least two ways into every important account.

How to start using passkeys

Start with your most important accounts: email first, then banking and payment services, then your password manager itself, then social media and cloud storage. Check the security settings of each service for a passkeys option — it is often labelled as passkeys, security keys, or sign in with your device. If a service does not offer passkeys yet, turn on two-factor authentication with an authenticator app instead.

When you create a passkey, save it where you will not lose it: your platform's built-in passkey store, or a reputable password manager that supports passkeys. Create a second passkey on a different device for your most important accounts, so losing one device does not lock you out. And keep your account recovery details — a recovery email and phone number — up to date.

Do not delete your password immediately after creating a passkey. Most services keep the password as a fallback, and you may need it on a device that does not support the passkey yet. Let the passkey become your normal way in, and keep the password as the safety net while the ecosystem finishes maturing.

• Start with email, then banking, then your password manager.
• Store passkeys in your platform store or a reputable manager.
• Create a second passkey on another device for key accounts.
• Keep recovery details up to date, and do not delete the password yet.

What happens if you lose your device

Losing a device does not mean losing your accounts. If your passkeys are synced — through your platform account or your password manager — you sign in on a new device, restore your passkeys from the synced store, and continue. If a passkey was device-bound to the lost device, you use the recovery method you set up: a second passkey on another device, a recovery code, or the account recovery process of the service.

This is why setting up recovery matters before you need it. When you create a passkey, check what recovery options the service offers and set up at least one. And protect the account that syncs your passkeys — your platform account or your password manager vault — with its own strong protection, because it is now the key to all your keys.

If your device is stolen, the thief still faces your device lock — your fingerprint, face or PIN — before the passkeys can be used, and most devices can be locked or wiped remotely. Report the loss, change the password of the syncing account from a clean device, and review your accounts for unfamiliar activity.

Passkeys and the future of passwords

Passkeys will not replace passwords overnight, but they are the clear direction of travel. Major platforms — the operating systems on your phone and computer, the largest email and shopping services, and most banks — now support them, and the standards behind them are final: WebAuthn Level 3 became a W3C Recommendation in August 2026, and NIST SP 800-63B Revision 4 recognises passkeys as the strongest common authenticator.

For now, the practical advice is simple: use passkeys where they are offered, keep passwords and two-factor authentication where they are not, and remember that the strongest defence is layered — a passkey where possible, a unique password and a second factor everywhere else. Passwords had a fifty-year run. Passkeys are what comes next, and they are already here.

Sources

• FIDO Alliance — Passkeys — last checked 14 November 2026.
• W3C — WebAuthn Level 3 — last checked 14 November 2026.
• NIST — SP 800-63B Revision 4, Digital Identity Guidelines — last checked 14 November 2026.
• National Cyber Security Centre (UK) — Password guidance — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

What is a passkey?

A passkey is a pair of cryptographic keys used to sign in instead of a password. The private key stays on your device and the public key is held by the website. When you sign in, your device signs a challenge with the private key, and the website verifies it with the public key.

Are passkeys safer than passwords?

Yes. A passkey cannot be phished, because your device only signs challenges from the genuine website. It cannot be guessed, cannot be reused across sites, and a stolen public key is useless without the private key that never leaves your device.

What is the difference between a synced and a device-bound passkey?

A synced passkey is stored in a password manager or platform key store and copied securely between your devices. A device-bound passkey lives on one physical device, usually a hardware security key, and cannot be copied off it. NIST recognises synced passkeys at Level 2 and device-bound passkeys at Level 3.

What happens if I lose the device with my passkey?

If your passkeys are synced, restore them on a new device from your platform account or password manager. If a passkey was device-bound, use the recovery method you set up — a second passkey on another device, a recovery code, or the service's account recovery process.

Do I still need a password if I use passkeys?

For now, yes, as a fallback. Most services keep the password while passkeys are being adopted. Keep a long, unique password and two-factor authentication on accounts that do not offer passkeys yet.