Passkey
Also known as: passkeys, passwordless sign-in, FIDO passkey
A passkey is a modern way to sign in that replaces passwords with a pair of cryptographic keys: a private key stays on your phone, computer, or password manager, and a public key is stored by the website.
You unlock it with your fingerprint, face, or device PIN. Because the key only works on the real website it was made for, passkeys resist phishing and can't be leaked in a password breach. While passkeys are far more secure and often faster, switching devices, sharing accounts, and recovering access can still be confusing.
Passkey, explained at three levels
At home
Think of a passkey as a wax seal only you own. Instead of telling a website a secret word, your device stamps the site's sign-in request with your seal, and the site checks it against a copy of the seal's pattern it saved when you signed up. You unlock the seal with your fingerprint, face, or PIN, so there's nothing to remember and nothing a scammer can trick you into typing.
At work
A passkey is a sign-in method that replaces the password with a cryptographic key stored on an employee's phone, laptop, or password manager. Staff unlock it with a fingerprint, face, or PIN, and the device proves who they are to the service without sending any secret. For a business, that means phishing emails can't harvest credentials, and password reset tickets to the help desk drop sharply.
At home
A passkey is really a pair of keys. When you create one, your device generates a private key, which it keeps, and a public key, which it gives to the website. At sign-in, the site sends a random challenge, your device signs it with the private key after you unlock it with your face, fingerprint or PIN, and the site checks that signature with the public key. No secret ever crosses the internet, so there is nothing to type into a fake page.
At work
Passkeys are built on the FIDO2 standards: WebAuthn in the browser and CTAP between the browser and an authenticator. Each passkey is tied to one website's domain, so a credential made for a bank simply cannot answer a look-alike domain. Synced passkeys copy the private key, encrypted, across a user's devices through Apple, Google or a password manager. Device-bound passkeys never leave one piece of hardware, such as a security key, which gives administrators stronger assurance about where the credential lives.
At home
While passkeys remove the password, they move trust onto the account that stores them. Apple, Google and password managers protect synced passkeys with end-to-end encryption, so the provider cannot read them, and they rely on your device lock or a recovery key to restore them on a new phone. That means your passkeys are only as safe as that account and its recovery options. In my view, securing that one account well is the trade you make for never typing a password again.
At work
A WebAuthn sign-in returns a signed assertion that includes the site's origin, a counter and flags saying whether the user was present and verified, which lets a server reject replays and weak checks. Registration can include attestation, a certificate proving the authenticator's make and model, so a policy can allow only approved hardware. Synced passkeys usually provide no useful attestation, which is why many organizations accept them for staff but require device-bound keys for administrators. Recovery flows remain the weak point attackers will aim for.
Real-world examples
At home
Sophie set up a passkey for her online banking. Now she signs in with her fingerprint, and a fake bank website in a phishing text couldn't use her passkey even if she clicked the link.
At work
Marcus is IT manager at a Halifax accounting firm. After moving staff to passkeys for Microsoft 365, password reset tickets dropped sharply and phishing attempts stopped working against those accounts.
How it compares
| feature | Passkey | Password |
|---|---|---|
| What you use | Fingerprint, face, or device PIN | Something you remember and type |
| Phishing risk | Very low | High |
| Breach risk | Website stores only a public key | Stolen passwords reused elsewhere |
| Recovery | Depends on device or cloud account | Reset by email or SMS |
Passkeys are easier and much harder to steal.
For analysts
For businesses, passkeys are one of the cheapest ways to stop phishing-driven account takeovers. I'd pilot them with IT and finance first, then plan recovery processes before a wider rollout.
History & origin
The FIDO Alliance, an industry group formed in 2013, developed standards for passwordless login, including FIDO2 and the W3C's WebAuthn standard, finalized in 2019. Early versions mostly relied on physical security keys. On May 5, 2022, Apple, Google, and Microsoft jointly committed to supporting passkeys that sync across devices. Apple launched passkeys in iOS 16 in September 2022, and Google added support for Android and Chrome later that year. Password managers such as 1Password and Bitwarden added passkey storage in 2023. Microsoft made new consumer accounts passwordless by default in 2025, and many banks, retailers, and services began offering passkeys. In my view, passkeys are the first password replacement that ordinary people might actually adopt, because they're easier, not just safer.