WiserHours
Menu

Follow your curiosity

Add a second lock · Lesson 5 of 11

What Is a Passkey? Sign In With No Password to Steal

Understand how a passkey signs you in with your face, fingerprint or PIN, why a fake site gets nothing, and which accounts to switch first.

FREE LESSON
Cover picture for lesson 5: What Is a Passkey? Sign In With No Password to StealVideo coming soon
The video is not out yet. The written lesson below has the same content.
THE WRITTEN LESSONFollow along at your pace

In this lesson, you will meet passkeys, a way to sign in without typing a password. That matters because a fake website cannot steal what you never type. You will also see what happens if you lose your phone, and which accounts to switch first.

Two matching keys

A passkey is made of two matching keys. The website keeps one. Your phone or computer keeps the other, and the website never sees it. When you sign in, your device uses its key to prove it is you, and the website checks that proof against its own key.

This has a handy side effect. If the website is broken into, thieves get only the website’s half, which is no use anywhere else. There is no password in the leak to try on your other accounts.

A cracked website holds one half of a key. Next to it, three doors, Email, Shopping and Bank, each marked with a cross, and a pill that says No use anywhere else. The matching half of the key sits on a faded phone labelled Your device.(opens the full-size picture)
A break-in at the website gives thieves only a half-key that opens nothing.

Your face, finger or PIN

To sign in, your device asks for your face, fingerprint or PIN, just like unlocking your phone. Your face or fingerprint stays on your device: the website only learns that the check worked.

There is nothing to remember or write down. When a site offers to “create a passkey”, your device makes the new pair of keys for you.

A phone asks Sign in with your passkey? with three choices: Face, Fingerprint and PIN. A tag says Stays on your device, and a dashed line leads to a website with a blue tick. A pill says Nothing to remember or write down.(opens the full-size picture)
You unlock a passkey the way you unlock your phone.

A fake site gets nothing

Each passkey only works on the website it was made for. On a fake copy of that site, your phone will not offer your passkey, even if the page looks exactly right. The fake site gets nothing to steal.

For example, a real parcel service at one address offers “Use your passkey?”. A lookalike at a slightly different address gets “No passkey for this site”.

Two example Parcel service sign-in pages. The real one, parcels.example.com, offers Use your passkey? with a blue tick. The fake one, outlined in red, is parcels-help.example.com, with the extra word underlined, and shows No passkey for this site. A pill says The fake site gets nothing.(opens the full-size picture)
Same look, different address: the passkey only appears on the real site.

Your warning sign

So if your passkey does not appear, and the page asks for your password instead, take that as a warning. Close the page. Then open the site from its app, or from a bookmark you saved yourself, and sign in there.

A phone home screen with an example Parcel service app ticked, or a saved bookmark for parcels.example.com marked with a star. A pill says Open the app or your own bookmark.(opens the full-size picture)
When in doubt, go in through a door you know.

If you lose your phone

What if you lose your phone? Synced passkeys are copied to your other devices through the account that keeps them, like your password manager. So you lose a phone, not your passkeys. On a new phone, sign in to that account, and they are there.

That makes the account that keeps your passkeys very important. Protect it with a strong password and two-step verification, from the lesson on two-step verification.

A card, The account that keeps your passkeys, For example, your password manager, holds four keys. Dotted lines copy them to a laptop, a tablet and a new phone marked Signed in. A pill says You lose a phone, not your passkeys.(opens the full-size picture)
Synced passkeys come back when you sign in on a new device.

Lock your phone well

The bigger risk is someone else opening your phone. With passkeys, whatever unlocks your phone also unlocks your accounts. A short PIN that someone has watched you type is now guarding your email.

So use a longer PIN, and make passkeys only on devices you own, never on a shared computer.

A locked phone with a longer PIN, ticked, is linked to Email, Shopping and Social accounts. Beside it, Your phone has a blue tick and Shared computer has a red cross. A pill says Passkeys only on devices you own.(opens the full-size picture)
Your phone's lock now guards your accounts too.

Which accounts to switch first

Britain’s National Cyber Security Centre advises using a passkey wherever one is offered. If you can’t do them all at once, go in this order:

  1. Your email, because whoever controls it can reset most of your passwords.
  2. The account that keeps your passkeys, such as your password manager.
  3. Accounts with money or saved cards, like shopping and payment accounts.

Many sites still keep a password as well. Keep that password strong and unique, and keep two-step verification on it.

A quote card, Use a passkey wherever one is offered, from the UK National Cyber Security Centre. Below, three numbered cards: 1 Your email, It can reset most others; 2 The account that keeps your passkeys; 3 Money and saved cards. A pill says Switch these first.(opens the full-size picture)
Start with the accounts that can unlock the others.

YOUR TURN

Read more

Read the full lesson script

In this lesson, you will meet passkeys, a way to sign in without typing a password. That matters, because a fake website cannot steal what you never type.

A passkey is made of two matching keys. The website keeps one. Your phone or computer keeps the other, and the website never sees it. If the website is broken into, thieves get only its half, which is no use anywhere else.

To sign in, your device asks for your face, fingerprint or PIN, just like unlocking your phone. Your face or fingerprint stays on your device. There is nothing to remember or write down.

Each passkey only works on the website it was made for. On a fake copy of that site, your phone will not offer your passkey. The fake site gets nothing.

So if your passkey does not appear, and the page asks for your password, take that as a warning. Close it, and open the site from its app or your own bookmark.

What if you lose your phone? Synced passkeys are copied to your other devices, through the account that keeps them, like your password manager. So you lose a phone, not your passkeys. On a new phone, sign in to that account, and they are there.

The bigger risk is someone else opening your phone. With passkeys, whatever unlocks your phone also unlocks your accounts. Use a longer PIN, and make passkeys only on devices you own.

Britain's National Cyber Security Centre advises using a passkey wherever one is offered. Start with your email, because whoever controls it can reset most of your passwords. Then the account that keeps your passkeys. Then accounts with money or saved cards.

So, a passkey is two matching keys, and a fake site gets nothing. Before the next lesson, check whether your email account offers a passkey, in its security settings. Next, you will learn to spot scam texts and emails.