Your phone asks for a fingerprint instead of a password. So what is a passkey? It is a FIDO-based sign-in credential stored on your phone, computer or security key, and it is safer than a password mainly because it resists phishing.
Passkeys are one layer of account protection. The wider habits sit in our guide on how to protect yourself from hackers. The main condition is recovery: a passkey is only as convenient as your plan for losing the device that holds it.
What a passkey is and how it works
The FIDO Alliance defines a passkey as an authentication credential based on FIDO standards. It can be stored on your phone or computer, and a hardware security key can hold one too. Each passkey is a cryptographic credential tied to your account on one website or application. Instead of a password you type, it replaces the password with a cryptographic key pair, which FIDO describes as giving phishing-resistant sign-in security and an improved user experience.
The two halves of that key pair live in different places. PasskeyCentral explains that your device or security key creates and securely retains the private key. The website never receives it. Google’s passkey documentation for developers says sites only save a public key to the server instead of a password. When you sign in, you approve the request on your own device, and the device proves it holds the private key.
The standards behind passkeys
Passkeys are built on FIDO2, which the FIDO Alliance describes as an open authentication standard that it developed. Its WebAuthn standard covers the browser API that manages passkeys. For you, that means the browser and operating system do the technical checking. You do not have to inspect anything yourself.
Passkeys and passwords side by side
| Feature | Password | Passkey | Planning use |
|---|---|---|---|
| What you use to sign in | A secret you type | A cryptographic key pair held by your device or security key | Expect a device prompt rather than a typed secret. |
| What the site keeps | A password | A public key only | Passkeys are designed so that there are no shared secrets. |
| Fake or look-alike sites | Open to phishing | Phishing-resistant; the browser or OS handles verification | Prefer the passkey option wherever a site offers it. |
| Strength | Not guaranteed to be strong | Always strong | You do not have to judge or invent a strong credential. |
| Fingerprint or face data | Not involved | Can approve the sign-in on the device; biometric material never leaves it | The unlock method stays local to your device. |
This comparison draws on the FIDO Alliance’s passkey overview and Google’s passkey documentation.
Common misunderstandings about passkeys
A passkey is not a fingerprint sent to a website
Many people assume that approving a sign-in with a fingerprint hands that fingerprint to the website. Google’s documentation says the opposite: biometric material never leaves the user’s personal device. The fingerprint or face check only unlocks the passkey on the phone or computer. The website still sees a cryptographic proof, not your biometric data.
Safer does not mean risk-free
Passkeys are safer than passwords in the ways that matter most for everyday accounts. The FIDO Alliance points to passwords as responsible for 80% of breaches today, and reports that 36% of people had at least one account compromised due to passwords. Passkeys address this directly. They are phishing-resistant, always strong, and designed so there are no shared secrets. Google adds that a user cannot be tricked into authenticating on a deceptive site, because the browser or OS handles verification. Yubico’s glossary lists the attack types that shrink as a result: credential stuffing, password reuse and remote phishing.
That list says reduced, not eliminated. Yubico also notes that synced passkeys make recovery easier after a lost or stolen device, but the cloud account that does the syncing becomes an added attack vector. Treat that account as part of your passkey security. Passkeys also protect only the sign-in step. If a message is trying to push you toward a fake page, the scam side is a separate problem, and what is smishing explains how text-message scams work.
Passkeys are no longer a niche feature
Support is built into mainstream operating systems. Microsoft’s passkey guidance lists these supported platform versions: Windows 10 and newer, macOS Ventura and newer, ChromeOS 109 and newer, iOS 16 and newer, and Android 9 and newer. If a device is older than these versions, check before you rely on passkey sign-in.
Adoption among ordinary users is also real. In a 2024 FIDO-commissioned survey, 53% of people reported enabling passkeys on at least one account, and 22% had enabled them on every account they could, according to the FIDO Alliance. The practical lesson is to enable passkeys where a service offers them and keep the rest protected the usual way for now.
If you lose a device that holds passkeys
Losing a phone does not automatically lock you out, but what happens next depends on the kind of passkey you created. PasskeyCentral says that, depending on the platform and authenticator type, passkeys may be synchronized across a user’s trusted devices.
Synced passkeys
Microsoft explains that synced passkeys can synchronize between your devices via a cloud service. Once a passkey is registered this way, Google says the user can switch to a new device and use it immediately without re-enrolling. For most ordinary users this is the easier model. A replacement phone signed in to the same account can pick up where the old one left off, and the lost phone is no longer your only copy.
Device-bound passkeys
Some passkeys never leave the hardware that created them. On a hardware security key, PasskeyCentral says, the passkey remains on that physical authenticator rather than being synchronized across devices. Microsoft states the consequence plainly: if you lose the device, you lose the passkey unless you have another recovery method. This model suits people who want a credential that cannot be copied, but it makes your own preparation matter more.
A short recovery checklist
- Find out which type you have. Check whether your platform syncs passkeys or keeps them on the device, because the loss scenarios differ.
- Add a digital spare key. Microsoft advises creating passkeys on your other devices too, such as a phone, tablet or laptop, so that one lost device does not strand an account.
- Keep another way back in. For accounts that rely on device-bound passkeys, set up a separate recovery method before you need it.
- Protect the syncing account. If your passkeys sync through a cloud account, secure that account carefully, since Yubico identifies it as an added attack vector.
Frequently asked questions
| Question | Answer |
|---|---|
| Is a hardware security key the same thing as a passkey? | No. A passkey is the credential, and a security key is one place it can be stored. Yubico says device-bound passkeys on hardware cannot be copied, shared or synchronized through a cloud service. It also describes using passkeys on security keys to set up and secure all other passkeys. |
| What happens if I follow a link to a fake website? | By design, PasskeyCentral says, a passkey is only presented to the site it was registered with. A look-alike address is a different site, so it does not receive your passkey. |
| Are passkeys a brand-new technology? | Not entirely. Yubico notes that a passkey is not a new technology but is based on the widely recognized FIDO2 and WebAuthn protocols. |
