Passkeys Explained and When to Replace Your Passwords

Most account takeovers I help clean up start the same way: someone typed a real password into a fake login page, or reused one that leaked years ago. Passkeys are designed to make both of those mistakes impossible. With passkeys explained in plain terms, the idea is simple: your device proves who you are with a cryptographic key that never leaves it, so there is nothing for a phishing site to steal and nothing to reuse.

Google, Apple, Microsoft, Amazon, PayPal and hundreds of other services now accept them. Yet most people I talk to either have not tried one or created a passkey by accident and are not sure what happened. Here is what passkeys actually do, where they still fall short, and how to switch without locking yourself out.

What a Passkey Is and How It Works

A password is a shared secret. You know it, the website stores a scrambled copy, and anyone who learns it can log in as you. A passkey replaces that with a pair of keys.

The private key stays on your device or in your password manager. It is never sent to the website.
The public key is stored by the website. On its own it is useless to an attacker.

When you sign in, the site sends a challenge. Your device signs it with the private key after you confirm it is you with your fingerprint, face or device PIN, and the site checks the signature with the public key. The whole exchange takes about two seconds.

Crucially, each passkey is bound to the exact website address that created it. A lookalike domain cannot request it, which is why passkeys stop phishing in a way passwords plus text codes never could.

Passkeys Explained Against Passwords and Two-Factor Codes

People often ask whether a passkey replaces their password, their two-factor authentication or both. In most cases it does both jobs at once, because it combines something you have (the device) with something you are or know (your biometric or PIN).

Method	Stops phishing	Stops reuse after a leak	Effort to sign in
Password only	No	No	Type it
Password plus SMS code	Partly	Yes	Type, wait, type
Password plus authenticator app	Partly	Yes	Type, open app, type
Passkey	Yes	Yes	One fingerprint or face scan

Authenticator codes are still a big step up from a password alone, as covered in two-factor authentication explained without the jargon. But a convincing fake page can still ask you to type the code and pass it on in real time. A passkey simply will not respond to the wrong domain.

Where Your Passkeys Are Stored

This is the part that confuses people most, and it decides how safe and convenient your setup is.

Synced passkeys

Apple iCloud Keychain, Google Password Manager and most third-party password managers sync passkeys across your devices. Create one on your phone and it appears on your laptop. Lose the phone, and your passkeys are still there once you sign in on a new device. For most people this is the right choice.

Device-bound passkeys

Hardware security keys and some work setups keep the passkey on one physical device only. That is stronger, because nothing ever syncs, but losing the key means losing that sign-in. These suit high-value accounts and people comfortable keeping a backup key in a drawer.

If you already use a password manager, check whether it supports passkeys; most major ones do now, and keeping everything in one vault makes switching phone brands much easier. If you have not set one up yet, here is why a password manager is the single best security upgrade.

The Common Advice I Would Not Follow Yet

Some enthusiastic guides tell you to delete your passwords the moment you add a passkey. I would not, at least not yet.

Many services still require a password as a fallback, and some will not let you remove it at all. Others support passkeys on one platform but not another, so you may sign in with a passkey on your phone yet need the password on an old work laptop or a smart TV. Recovery flows at several companies still fall back to email or SMS, which means your account is only as strong as that weakest route.

The practical approach is to add passkeys, keep a strong, unique password stored in your password manager, and keep your recovery options locked down. Treat the password as a spare key in a safe, not something you type every day.

How to Switch Your Most Important Accounts

Do not try to convert everything in one afternoon. Start with the accounts that would hurt most if lost.

Your main email. Whoever controls it can reset everything else. Add a passkey in the account's security settings.
Your phone platform account. Your Apple or Google account holds your synced passkeys, so protect it well.
Your password manager, if it supports passkey sign-in.
Banking and payment accounts where offered, such as PayPal.
Shopping and social accounts as you next sign in to them.

For each one, add the passkey, sign out, and sign back in with it before moving on. That ten-second test confirms it works before you rely on it.

Plan for a Lost or Broken Phone

Lockouts are the real risk with any stronger sign-in method. Prepare before you need it.

Register passkeys on at least two devices, for example your phone and your laptop, or use a synced manager.
Make sure you know the password and recovery steps for the account that syncs your passkeys.
Save backup codes for your email and platform accounts. Our guide on where to keep 2FA backup codes covers safe places to store them.
Consider one hardware security key as an extra sign-in method for your main email.

FAQ

Can someone use my passkey if they steal my phone?

Not without getting past your screen lock. Using a passkey requires your fingerprint, face or device PIN. Keep a strong PIN, not 1234 or your birth year, because that PIN is now guarding your accounts.

Do passkeys work on shared or public computers?

Yes, through a QR code. The computer shows a code, you scan it with your phone, and your phone completes the sign-in over Bluetooth. No passkey is left on the shared machine.

Are passkeys safe if a website gets hacked?

The website only stores your public key, which cannot be used to sign in. A breach exposes nothing that lets an attacker log in as you elsewhere, unlike a leaked password.

Set Up Your First Passkey Today

Open the security settings of your main email account, add a passkey, and test it by signing out and back in. Then save your backup codes somewhere safe. That one account, done properly, protects more than any number of complex passwords. Next week, add a second device so a lost phone never becomes a lost account.