Passkeys Explained: What They Are and Whether to Switch

Signing in with a passkey involves nothing to type, and that is the point: a fake login page cannot collect what you never enter.

So what is a passkey? It is a sign-in that replaces your password with a pair of matching digital keys. One stays on your phone, computer, password manager or security key; the other sits with the website. You approve each login the way you open your device, with a fingerprint, a face scan or a PIN.¹ In April 2026 the UK’s National Cyber Security Centre (NCSC) told consumers to pick a passkey over a password on any service that offers one, judging a passkey at least as secure as the strongest password paired with a second sign-in step.²

Whether to switch has a short answer too: yes, one account at a time. Start with your main email and with the Apple, Google or Microsoft account (or password manager) that will hold your passkeys, because those two can reset the rest, and keep a strong password wherever a site still asks for one. The full switch order closes this guide.

What is a passkey and how does it work?

A passkey is a pair of cryptographic keys that your device creates for one account, as Apple’s security documentation explains it. The website stores the public key, which anyone may see. Your device keeps the private key, which is what signs you in, and the website never learns it.³

At sign-in, the website sends your device a small challenge. Once you confirm it is you, the device signs the challenge with the private key, and the site checks that signature against the public key it holds.⁴ Think of a wax seal. The site keeps a picture of your seal’s imprint, good enough to recognize a letter you sealed but useless for making a new one. Only the seal itself, locked inside your device, can do that.

“Passkey” is a general term, not one company’s feature. Passkeys are built on the FIDO2 standards from the FIDO Alliance, an industry group, and the word works like “password”: the same kind of credential on every platform.¹ Apple announced passkey support for its devices in 2022, Google followed later that year for Android and Chrome, and Microsoft brought them to Windows 11 in 2023.⁵

Myth

A passkey sends my fingerprint or face to the website.

Fact

The fingerprint or face check happens on your device and stays there; the FIDO Alliance says the server only sees that the check succeeded.

So when a site offers to “create a passkey,” it is asking your device to make a new key pair for that account. You invent nothing, remember nothing and write nothing down. The one thing worth checking is that you say yes on a device you own and keep locked.

Why a fake website can’t get your passkey

A passkey resists phishing because it is tied to the web address that created it. Microsoft’s help pages give the example of a passkey made for netflix.com: it works only on netflix.com, and if you land on a lookalike site, your device will not offer it.⁴

Compare that with a password and a texted code. Both are codes you hand over, so a convincing fake page can pass them to the real site while you watch. The NCSC calls every traditional second step, from text codes to app approvals, inherently phishable, because a code or an approval can be relayed to the real site during a live session.⁶ A passkey gives the fake page nothing to pass on. And if the real website is breached, the NCSC notes that attackers get only the website’s half of the key pair, which cannot be used anywhere else.⁷

An email says your delivery account is locked, with a link to a page that looks right. With a password, you might type it in before you notice the address is off. With a passkey, your phone shows no passkey for that site, and that missing prompt is the warning.

The US Cybersecurity and Infrastructure Security Agency (CISA) reached the same verdict for organizations in 2022, calling FIDO/WebAuthn the only widely available phishing-resistant sign-in method.⁸ The NCSC’s 2026 paper made the comparison for personal accounts.

The study

Moderate evidence

Where passkeys hold up and where they don't: the NCSC's attack-by-attack review (2026)

The UK’s NCSC rated each sign-in method against the attacks it sees used on individuals. A password with a second step was always vulnerable to real-time phishing that relays the code, and potentially to floods of approval requests; passkeys were never vulnerable to either. Passkeys were not immune everywhere: malware on your device and phishing of the account that syncs them depended on the situation, and a stolen device with a weak PIN left them potentially vulnerable. So the NCSC says you still need to keep your device secure and protect the account your passkeys sync through.⁹

The paper is analysis, not a count of prevented break-ins, so read it as expert judgment rather than a measured result. The NCSC’s Dave Chismon, writing on the agency’s blog, put the central point plainly.

Passkeys remove this class of attack entirely by cryptographically binding authentication to the legitimate service.

The habit to build from this is small: when a page that claims to be a site you use offers no passkey and asks for your password instead, close it and open the site from its app or a bookmark you saved yourself.

Where passkeys are stored and synced

Every passkey lives with a passkey provider. According to the FIDO Alliance, that is either the credential manager built into your phone or browser, such as iCloud Keychain or Google Password Manager, or a separate password manager such as 1Password or Dashlane. A passkey can also live on a hardware security key. Synced passkeys copy themselves to your other devices through your provider’s account; device-bound ones never leave the phone, computer or key where they were made.¹ Where a passkey lives decides which devices can use it and what happens when one goes missing.

For most people, synced is the forgiving choice. So pick one main home for your passkeys and make it one that runs on every device you use. If your household mixes an iPhone with a Windows laptop, the NCSC’s advice for password managers applies: it suggests a reputable independent manager for people whose devices come from several makers, or who would rather not depend on one company.⁷ Comparing password managers that also hold passkeys is the next step if you go that way.

What happens if you lose your phone

With synced passkeys, a lost phone costs you a device, not your sign-ins. Microsoft’s help pages say that when you sign in to your credential manager on a new device, whether that is Microsoft’s, Google’s or Apple’s, your passkeys are there without creating new ones.¹²

Apple goes further: its documentation says iCloud Keychain passkeys can be recovered even when every one of your Apple devices is gone, through an encrypted escrow that requires your Apple Account password, a text code and your device passcode.³ Device-bound passkeys are different. Microsoft says that if you lose the device, you lose the passkey unless you have another way in, and suggests making passkeys on your other devices too, as a spare key.⁴

The bigger risk is someone else opening your phone. Google warns that once you create a passkey, anyone who can open your device can get into your Google Account, and advises creating passkeys only on devices you personally own.¹³ A four-digit PIN your nephew has watched you type is now guarding your inbox.

In practice, that means a longer device PIN, two-step verification on your Apple, Google or Microsoft account, and a plan for getting into that account from a new phone.

Rough edges: other devices, shared logins and password fallbacks

Passkeys work well inside one ecosystem and less smoothly at its edges. Four gaps are worth knowing before you switch.

Other people’s devices

You can sign in on a library or friend’s computer by choosing the option to use a passkey from a nearby device, then scanning the QR code it shows with your iPhone.¹⁴ Google’s help pages describe the same QR-code route for a Google Account and ask you to switch Bluetooth on.¹³ Try it once at home, on your own laptop, so the first time is not at a hotel desk with a queue behind you.

Moving between providers

Until recently, a passkey saved in one manager stayed there. A credential exchange format developed within the FIDO Alliance is changing that. Since iOS 26 and macOS 26, passkeys can move between password apps on Apple devices that support the transfer, such as Apple Passwords, 1Password, Bitwarden and Dashlane (not every app supports it on the Mac yet), according to Ricky Mondello, who works on passwords at Apple and writes his blog in a personal capacity.¹⁵ Elsewhere, check your manager’s export options, or create a new passkey in the new manager and delete the old one.

Shared accounts

Google points out that, unlike passwords, passkeys can’t be shared or copied.¹³ Apple is the exception within its own ecosystem: shared password groups let family members use the same passkeys, if each has an Apple device on iOS 17, macOS 14 or later.¹⁶ A streaming account shared across mixed phones may be one to leave on a strong, managed password for now.

The password is usually still there

As of 2026 most platforms still offer other sign-in methods alongside passkeys, which can reduce the benefit.⁵ An attacker who can’t phish your passkey can still try the old password or the recovery route. Keep that password long, unique and in a manager, and keep the second step on it.

Banks are a special case. Under the EU’s payment rules, banks in the European Economic Area must check two independent factors for online payments, and in the UK the consumer group Which? found in 2019 that many banks did so with a text message or an app notification.¹⁷ Wherever you live, your bank may use its own app-based scheme rather than passkeys, even when your phone supports them; use its official app and the sign-in it provides.

Which accounts to switch first

Switch the accounts that protect other accounts first. The NCSC’s advice is simple: use a passkey wherever a service offers one, and where it doesn’t, use a password manager to create strong passwords and keep two-step verification on. It named Google, eBay and PayPal among popular services that already support them, and cited Google data showing that just over half of active users of Google services in the UK had registered a passkey.² Readers in other countries can find the matching advice from their own government’s cyber agency.

You won’t be early elsewhere either. The FIDO Alliance estimated in May 2026 that about 5 billion passkeys were in use worldwide, a figure from the industry body’s own mix of public and member data.¹⁸ A sensible order, based on which accounts can reset or impersonate the rest:

1. Your main email account. Whoever controls it can reset most of your other passwords, which is why a starter routine for protecting accounts and devices puts it first.
2. The account that stores your passkeys. Your Apple Account, Google Account, Microsoft account or password manager now holds the keys to everything else.
3. Accounts with money or saved cards. Shopping, payment and marketplace accounts that offer passkeys.
4. Social and messaging accounts. People trust messages from you, so a hijacked account is a ready-made scam channel.
5. Everything else, as sites offer it. Accept the “create a passkey?” prompt when it appears on a device you own.

A no means the screen lock and the syncing account need work before anything else moves to passkeys.

Before and while you switch

• Set a longer PIN or passcode on my phone
• Protect the account that syncs my passkeys with two-step verification
• Create a passkey for my main email account
• Create one for my Apple, Google or Microsoft account or password manager
• Add passkeys to shopping, payment and social accounts that offer them
• Keep a strong, unique password in my manager for every site that still uses one

Download PDF ↓

Get this checklist as a one-page PDF. We'll email you the download link.

Your emailAlso send me the weekly newsletter (launching soon)Email me the PDF

We use your address to send this link and, only if you tick the box, the newsletter. Privacy policy.

The bottom line

A passkey is a key pair your device keeps for one website, opened with the same fingerprint, face or PIN you use for your phone, and it can’t be typed into a fake page. Switch your email and the account that stores your passkeys first, protect your phone with a strong screen lock, and keep good passwords in a manager for the many sites that still ask for one.