Passkeys Explained: What Replaces the Password

The site stores nothing a thief could sign in with.

When you create a passkey, your device generates a unique pair of cryptographic keys for that one account. Apple’s security documentation describes the split: the public key is stored on the website’s server and is not a secret; the private key stays with you, is what actually signs you in, and is never learned by the server. There is no shared secret to leak in a breach and nothing to reuse on another site. Google puts the consequence plainly: unlike passwords, passkeys can’t be shared, copied, written down, or accidentally given to someone else.

A face, a fingerprint, or the screen-lock PIN approves it.

To sign in, you approve the request the same way you unlock your phone or computer — fingerprint, face scan, or device PIN — according to the FIDO Alliance, the industry group behind the standard. Google notes that the biometric data used for this stays on your device and is never shared with Google. Underneath, passkeys use the FIDO2 standards: WebAuthn, the browser interface, and CTAP, which connects authenticators such as a phone or a security key.

The key only answers to the site that created it.

Phishing works on passwords because a person can be fooled into typing one into a look-alike page. A passkey involves nothing to type, and its key is bound to the domain where it was created. NIST’s 2025 guidelines explain that this prevents a falsified web page from capturing the authenticator’s output and reusing it — the property NIST calls phishing resistance. It is the same protection that puts security keys at the top of the two-factor ranking.

Sync is what makes a lost phone survivable.

Passkeys can be synced across your devices or bound to a single device, such as a hardware security key. Apple syncs them through iCloud Keychain, which is end-to-end encrypted, and says they can be recovered even if you lose every device: recovery requires your Apple Account password, a reply to a text sent to your registered phone number, and a device passcode, with a limited number of attempts. On other platforms, the passkey provider decides how sync and recovery work, so check its documentation before you depend on it. NIST’s federal guidelines accept synced passkeys up to their second assurance level, but not for the highest, which requires a key that cannot be exported from the hardware.

Two cautions from the platforms.

Create passkeys only on devices you personally own and use. Google warns that once a passkey is on a device, anyone who can unlock that device can get into your account, even if you sign out. Check the basics, too. Google lists support from Windows 10, macOS Ventura, iOS 16, and Android 9, with Chrome or Edge 109, Safari 16, or Firefox 122 and later. A screen lock must be on, and on Apple devices so must iCloud Keychain.

Keep securing the fallback.

Adding a passkey to a Google Account does not change or remove the account’s other sign-in and recovery methods, and signing in with the passkey satisfies the second step of 2-Step Verification, because it proves you hold the device. The old password and recovery options still work, so they still deserve a unique password and a second factor. If a work or school administrator manages the account, signing in with a passkey alone may not be allowed.