What are passkeys, and how do you start using them?

Passwords have two stubborn problems: people reuse them, and fake websites can steal them. Passkeys are a sign-in method that removes both. Instead of typing a password, you confirm it's you with whatever you use to unlock your phone or computer — fingerprint, face or PIN.

They're built on open standards backed by the FIDO Alliance and the W3C, and they're supported by Google, Apple, Microsoft and a growing number of services.

#How they work, simply

When you create a passkey for a service, your device generates two linked keys:

• A private key, which stays on your device or in your password manager and is never sent anywhere.
• A public key, which the service stores.

When you sign in, the service sends a challenge that only your private key can sign. Your device asks for your fingerprint, face or PIN to authorise the signature. The service checks it with the public key and lets you in.

What matters:

• There's no secret you could type into a fake website.
• The passkey is tied to the service's real domain, so a phishing site can't request it.
• If the service is breached, only public keys leak — and they can't be used to sign in.

#Passkeys vs passwords and 2FA

On many services a passkey acts as both first and second factor. Where you still use passwords, two-factor authentication remains essential.

#Where passkeys are stored

• In your system's manager: iCloud Keychain (Apple), Google Password Manager (Android and Chrome) or Windows Hello.
• In compatible third-party password managers, which let you use them across platforms.
• On a physical security key (USB or NFC).

Stored in a synced manager, they're available on all your devices signed into that account — so you don't lose them when you change phones.

#Creating your first passkey

Start with your main account, such as Google:

1. Open your account's security settings.
2. Find Passkeys (or "Passkeys and security keys").
3. Tap Create a passkey and confirm with your fingerprint, face or PIN.
4. Next time you sign in, the service will offer to use it.

On other services, the option usually lives under Security, or pops up at sign-in ("Create a passkey?").

#Signing in on someone else's computer

If you need to sign in on a computer that isn't yours, many services let you use your phone's passkey by scanning a QR code. Phone and computer communicate over Bluetooth to confirm you're nearby, and the passkey isn't copied to the computer.

#Precautions and common questions

• What if I lose my phone? If your passkeys live in a synced manager, they're still on your other devices. Keep your accounts' recovery options up to date too.
• Can I still use my password? On most services, yes — the passkey is added as an option. Some let you remove the password later.
• Is my fingerprint sent anywhere? No. Biometrics only unlock the passkey on your device; they never leave it.
• Shared devices: don't create passkeys on devices other people can unlock.

#The bottom line

Passkeys are more convenient and more secure than passwords, because there's nothing to remember and nothing to type into a fake site. Start by creating one for your main account and add more as your services offer them. While passwords are still around, use a password manager and learn to spot phishing.