What Is a Passkey? How Passkeys Work and Differ From Passwords

You clicked into your account settings and saw a button: "Create a passkey." Before you tap it, here's what you're agreeing to.

A passkey is a cryptographic credential tied to your account on a specific website or app. You don't create it yourself, and you don't need to remember it. Instead, your device generates it, and you unlock it the same way you already unlock your phone or computer: with your fingerprint, your face, or a PIN.

That's the part worth being precise about upfront: your fingerprint or face scan isn't the passkey. It's just the everyday action that gives you permission to use one.

Below: how creating and signing in with a passkey works, how it's different from a password, where your passkeys live, and what happens if you lose your phone or switch devices.

How Do Passkeys Work?

What Happens When You Create a Passkey?

When you create a passkey, your device generates a pair of cryptographic keys tied to that specific account and that specific website.

One of those keys is public. It gets sent to the website and stored on its server. The other is private, and it never leaves your device or your passkey provider, the app or service responsible for creating and protecting it. The website never receives your private key, and it never receives your fingerprint or face scan either. Both stay local to your device.

Passkeys come in two forms, synced or device-bound, which affects where you'll find them later. More on that difference in the storage section below.

What Happens When You Sign In?

Signing in follows a fixed sequence:

1. The website sends a verification request to your browser.
2. Your browser passes that request to whichever passkey provider you have available, your phone, your computer's credential manager, or a hardware security key.
3. You approve the request the way you already unlock that device, fingerprint, face, or PIN.
4. Your device uses your private key to create a cryptographic signature, proving you have it, without ever sending the key itself anywhere.
5. The website checks that signature against the public key it already has on file. If it matches, you're signed in.

Nothing about this sends your biometric data to the website. Your device confirms locally that you're really you, and only the resulting signature travels anywhere.

Passkey vs Password: What's the Difference?

Here is where people usually get tripped up:

Autofilling a saved password isn't the same as using a passkey, even though both can feel like a one-tap sign-in. It's still the same password underneath.

One PIN on your device can unlock many different passkeys, for many different accounts. It's not a single master password for the internet, it's just the same local unlock step applied separately to each one.

Creating a passkey for an account doesn't automatically delete your password for it. Many sites keep both around, at least for a while, and some let a password stay as a fallback.

And "passwordless" is a broader category than "passkey." A one-time code texted to your phone is also a form of passwordless sign-in, but it isn't a passkey and doesn't carry the same phishing resistance.

Are Passkeys Safer Than Passwords?

For the specific job of signing in, yes, in ways that are fairly well established. The UK's National Cyber Security Centre reviewed the security of passkeys against traditional multi-factor setups and concluded passkeys hold up as well or better than 2-step verification using even a strong password. That's a meaningful comparison, not a marketing line, since it accounts for the layered defenses passwords are usually paired with today, not just a bare password on its own.

What Passkeys Protect Against

The phishing resistance comes from how a passkey is tied to a specific website's identity, not just typed text that could go anywhere. When your browser is about to use a passkey, it checks that the site asking for it is the same one the passkey was created for. A convincing fake login page, even a pixel-perfect copy, is still a different address behind the scenes, so it simply can't get your device to produce a valid signature. That's a structural check your browser makes, not something that depends on you noticing a suspicious URL yourself.

Password reuse across sites disappears as a risk too, since a passkey for one account is worthless anywhere else. And because the public key sitting on a website's server isn't a secret, a server-side breach that exposes it doesn't hand an attacker anything they can use to sign in as you, unlike a leaked password database.

It's also worth not lumping every second-factor method together as equally strong. A password paired with a text-message code is still phishable, since both pieces can be typed into a fake site. A hardware security key is a different category entirely, closer to a passkey's own phishing resistance than to an SMS code.

What Passkeys Don't Solve

A passkey protects the moment you sign in. It doesn't protect everything around that moment.

If your device itself is compromised, malware running on it, or someone who's gotten past your screen lock, your passkeys are exposed the same way anything else on that device would be. A stolen, already-open session (the cookie that keeps you logged in after you've signed in) isn't touched by passkeys at all, since that theft happens after sign-in, not during it. And any backup or recovery path tied to your account, an old security question, a recovery email you no longer check, an SMS number you switched away from, is only as strong as its weakest link, regardless of how strong your passkey is.

None of this makes passkeys weak. It means "safer at sign-in" and "your account can never be compromised" are different claims, and only the first one is accurate.

Where Are Passkeys Stored?

Synced Passkeys

Most people end up with synced passkeys, managed by a passkey provider like Apple's iCloud Keychain, Google Password Manager, or a third-party credential manager such as 1Password or Dashlane.

Here's what that provider does: it creates and protects the passkey, uses your device unlock to confirm it's really you before letting the passkey be used, and copies (syncs) it to your other devices signed into the same account with the same provider. That's how a passkey you create on your phone can show up ready to use on your laptop without you doing anything extra.

Apple's own security documentation is a useful specific example here: passkeys sync through iCloud Keychain, which is end-to-end encrypted, and are recoverable even if every device you own is lost, through an escrow process that still requires your account password, a code sent to a trusted device, and your device passcode to unlock. Google Password Manager and third-party providers each have their own version of this, and the exact steps differ by provider, not by some universal passkey standard.

Device-Bound Passkeys

Some passkeys are deliberately built to never leave a single device or hardware security key. These are common on dedicated USB or NFC security keys, and they're the choice some people make for a specific account, a bank, an email account, a crypto wallet, where they want the strongest possible guarantee that the credential exists in exactly one physical place and nowhere else.

The tradeoff is direct: nothing to sync means nothing that can be recovered through a cloud provider either. If that specific key or device is lost, you're relying on whatever backup sign-in method the website itself offers, not a passkey provider's recovery process.

A Short Map of Who Does What

None of this is fixed for every situation. A passkey isn't always sitting in your browser specifically, it isn't guaranteed to sync everywhere automatically, and it doesn't always stay locked to the device it started on. Which of those is true for a given passkey depends on which provider created it and how you set it up.

How to Create and Use a Passkey

The exact wording changes from service to service, but the shape of the process is usually the same:

1. Check that the site or app you're using supports passkeys.
2. Go into your account's security or sign-in settings.
3. Look for an option to create or add a passkey.
4. Confirm where it's being created, which passkey provider is handling it.
5. Approve the prompt using your device's unlock method.
6. Sign out and back in once to confirm it works, and make sure you still have a backup way into the account.

A Google Account Example

Here's what that looks like concretely, checked against Google's own current instructions as of this writing.

In your Google Account, under Security, there's a dedicated Passkeys and security keys page. Tapping "Create a passkey" prompts you to unlock your device, and that's the entire creation step, no forms, no new credentials to invent. The next time you sign in, entering your username on Google's sign-in page can surface a saved passkey directly as an autofill-style option; selecting it and unlocking your device is the whole sign-in. Every passkey you've created shows up on that same Passkeys and security keys page, where you can also remove one if you've lost the device it's tied to.

A few things apply no matter which service you use: you generally don't need a fingerprint sensor specifically, a device PIN or pattern usually works as an equally valid unlock method. Don't create a passkey on a device other people also use, since unlocking that device becomes enough to access the account. And creating a passkey isn't a reason to immediately go delete every backup way into your account, keep at least one working fallback until you've confirmed the passkey works the way you expect.

What If You Lose Your Phone or Change Devices?

Four things get confused with each other constantly:

Syncing is what makes a passkey available across your own devices through one provider. Cross-device sign-in is different: it lets one device (usually your phone) help you sign in on another device for that one session, without copying the passkey over. Recovering your credential manager gets you back into the vault holding your passkeys. Recovering your account on a specific website is that website's own separate process, and having your passkeys back doesn't automatically fix a locked-out account if something else about it needs verifying.

A new phone doesn't automatically restore access to every account you had passkeys for. It restores access to your passkey provider, and from there, to whichever passkeys that provider has synced.

Should You Start Using Passkeys?

Where they're offered, yes, generally, but it's worth checking a few things first rather than tapping "Create a passkey" on autopilot:

• Does the specific site you care about support passkeys yet?
• Do you know which passkey provider will end up holding it?
• Does that provider work across the devices you use day to day?
• Is the device itself protected with a screen lock or PIN, since that's now doing double duty?
• Do you still have a working backup way into the account?
• Do you understand that recovering your passkey provider and recovering your account on that specific website are two different processes?

You don't need to convert every account at once. Passkeys and passwords can coexist on the same account for as long as a site allows it, so a gradual switch, starting with the accounts that matter most, is a reasonable way to do this.

Frequently Asked Questions

Is a passkey the same as a fingerprint or Face ID?
No. Your fingerprint or face scan is just how you approve using the passkey that's already stored on your device. The passkey itself is a cryptographic credential; your biometric data never leaves your device and is never sent to the website.

Can I use a passkey without biometrics?
Yes. A device PIN or pattern works the same way a fingerprint or face scan does, as the unlock step that authorizes the passkey. Which options are available depends on your specific device and passkey provider.

Do I still need a password after creating a passkey?
Often, at least for a while. Whether a site lets you remove the password entirely, keeps it as a fallback, or requires it for certain actions varies by service. Don't assume it's safe to delete your password just because you've added a passkey, check that specific site's settings first.

Do passkeys replace two-factor authentication?
They change what two-factor authentication looks like more than they eliminate it. A passkey already combines something you have (your device) with something you are or know (your biometric or PIN), so many services treat a passkey sign-in as satisfying 2FA on its own rather than asking for a separate second step. That's a decision each service makes, not a universal rule, so don't turn off 2FA elsewhere assuming a passkey covers it.

Will clearing my browser cache delete my passkeys?
Not on its own. Cache is temporary, disposable data your browser keeps to load pages faster, it isn't where your passkeys are stored. Your passkeys live with your passkey provider, whether that's your device's built-in credential manager or a separate app. That said, some browser or device cleanup options go further than clearing cache, wiping a browser profile or resetting a credential manager can remove passkeys, so check exactly what any "clear data" option covers before using it. For more on what does and doesn't get removed, see what clearing your browser cache removes.

Do passkeys make me anonymous online?
No. A passkey makes it harder for someone else to sign in as you, which is a different problem from being tracked while you browse. Signing in securely and staying untracked are separate goals, addressed by different tools. For that second one, see how websites track you.