People have been talking about "the end of passwords" for years, and for the first time there is a technology that makes it real for ordinary users: passkeys. Many services already suggest them at sign-in with a message like "Would you like to create a passkey?". Understanding what happens behind that button helps you use them with confidence and avoid surprises.
The problem they solve
A password is a shared secret: you know it, and the server knows it in some form. That creates two weaknesses. First, the secret can be stolen from the server during a breach. Second, you can be tricked into typing it on a fake website. Passkeys remove both weaknesses because there is no longer a secret to type or to store on the server.
How they work, without the maths
When you create a passkey for a service, your device generates a key pair:
- a private key, which stays on the device (or in your encrypted keychain) and is never sent to anyone;
- a public key, which is handed to the service.
When you sign in, the service sends a challenge, a piece of random data. The device signs it with the private key after you confirm with your fingerprint, face or PIN. The server checks the signature with the public key. If it matches, you're in.
The crucial point is that the passkey is bound to the domain of the site it was created for. If a fraudster lures you to a copy of your bank's page at a different address, the device finds no valid passkey for that domain and signs nothing. There's nothing to steal and nothing to type by mistake.
Technically they are based on the FIDO2 and WebAuthn standards, the same ones used by physical security keys.
Fingerprint and face: who sees them?
A frequent concern is biometric data. With passkeys, your fingerprint or face is used only to unlock the device locally: it isn't sent to the website. The service receives only a cryptographic signature. If you prefer, you can use the device PIN instead of biometrics.
Where they are stored
There are two main modes:
- Synced passkeys: stored in the system keychain (for example Apple's or Google's) or in a compatible password manager, encrypted and synced across your devices. If you change phones, they come with you.
- Device-bound passkeys: they stay on a physical security key or a single device. They give you the most control, but if you lose that device you lose the passkey too.
For most people synced passkeys are the most practical choice. Those managing particularly sensitive accounts may prefer a physical key.
Signing in from a computer that isn't yours
If you need to sign in from a computer that doesn't hold your passkey, many services show a QR code: you scan it with your phone, confirm with your fingerprint, and the phone authorises the sign-in over a short-range Bluetooth connection. The physical proximity required makes this mechanism hard to abuse remotely.
What to do if you lose your phone
This is the most important question, and the answer depends on how you've prepared:
- if your passkeys are synced, you regain access by restoring your Apple, Google or password manager account on a new device; that's why the account holding your passkeys must have up-to-date recovery methods;
- it's wise to register more than one method on every important service: a second passkey on another device, a physical key, or an authenticator app;
- keep the recovery codes that services offer.
Current limits
Passkeys aren't available everywhere yet, and the experience varies between operating systems, browsers and password managers. Some services still keep the password as an alternative: in that case overall security also depends on that password, which should be long and unique. Moving passkeys between different ecosystems is improving, but still needs some care.
How to get started
- Start with accounts where the option is already offered: email, your phone account, your password manager.
- Create the passkey from the service's security settings, not from links you receive.
- Check that it has synced by signing in from a second device.
- Keep at least one backup method for each account.
In short
- Passkeys replace the password with a key pair: the private key never leaves your device.
- They are bound to the site's domain, so they resist phishing by design.
- Your fingerprint or face stays on the device and only unlocks it.
- Synced passkeys survive a phone change, provided the account holding them is well protected.
- Always register a backup sign-in method.