Passkeys Explained: How to Set Them Up and When to Keep a Password

Short answer: A passkey is a login kept on your devices, not a password you type. The site stores a public key. The private key stays on your phone, computer, password manager or security key, and you unlock it with the same PIN, fingerprint or face check that opens the device. Passkeys are harder to phish than passwords or text message codes. They do not remove the need for a second way in. Add one only when you know how you would recover the account.

In this guide

• What a passkey is
• How passkeys differ from passwords
• How passkeys differ from two-factor checks
• Before you create one
• Set a passkey up on your phone
• Set a passkey up on a computer
• Sign in on another device
• When to keep a password
• Recovery planning
• A sensible order of work
• If something does not work
• FAQ

What a passkey is

When you create a passkey, your device makes two related keys. The website stores the public key. The private key stays in a protected place: the device, a cloud keychain on your Apple, Google or Microsoft account, a password manager, or a hardware security key.

You never choose or type the characters. To sign in, the site asks the device to prove it has the private key, and the device agrees only after you unlock it. The result is a one-time signature for that visit. The private key is not sent to the site, and there is no code to read out to a caller.

The secret stays with you. The site keeps the half that checks the proof. A stolen list of public keys is not a list of passwords, because the private half should never have left your device or your password manager.

Synced, or tied to one device

A synced passkey is encrypted and copied across devices on the same account. If sync is really on, losing the phone need not lose the passkey. Check that it has arrived on a second device rather than trusting the label alone.

A device-bound passkey stays on one phone, one computer or one security key. It will not appear on a new device by itself. That can be a deliberate choice for a valuable account. It is also how a single broken phone becomes a lockout.

Read the save prompt. The account or app it names is the home of this passkey. If you do not use that account on your other devices, pick a different home, or plan a second passkey before you depend on the first.

How passkeys differ from passwords

A password is a shared secret. The site keeps a checkable copy, usually scrambled. Reuse that secret and a leak in one place can open another account. Type it into a lookalike page and someone else now has it.

A passkey is not a phrase you can reuse or read aloud. The site does not receive the private key, and the key is tied to the genuine site address, so a copycat page should not be able to trigger it. That is useful resistance to phishing. It does not, by itself, make the site’s account recovery safe.

Your device PIN still matters, because it unlocks the key. A weak recovery option on the website can still be abused. A passkey saved in a password manager is only as protected as that manager and the account wrapped around it. The National Cyber Security Centre’s top tips for staying secure online remain a sound baseline beside any passkey: look after the accounts that matter, and do not rely on a single habit.

Comparison	Password	Passkey
What you create	A phrase you type	Keys the device creates
What the site keeps	A checkable copy of the secret	The public key only
On a fake page	You can type it in	It should not be offered
How you unlock	Type it, often plus a code	Unlock the device or key

How passkeys differ from two-factor checks

Two-factor authentication adds a second check beside a password. That check might be a text message code, a code from an authenticator app, a prompt in an app you already trust, or a tap on a hardware key. It helps because the password on its own is no longer enough.

A passkey is not just another code. On many sites it takes the place of the password. Unlocking the device shows that you are present, and the signature shows that the right key is present. You may not see a password box or a six digit code at all.

Some sites are only halfway there. You might type a password and then use a passkey, or see the passkey listed next to older options. The screen on that account is the rule. Nothing you set up on one site changes every other account you own.

Codes you type have a gap that passkeys are built to close. A fake page can ask for the password and then for the digits, and both can be used straight away. A passkey prompt is tied to the address the browser is actually on, so it should not appear for a lookalike. Phone calls can still rush people into bad decisions. What this blocks is the specific trick of getting you to read a code aloud.

A mobile number used for codes can sometimes be taken over. An authenticator app avoids that particular route, so it is a sound thing to keep while a password is still on the account. Leave the older recovery in place until a passkey has worked on a second device. Do not switch anything off on the first afternoon.

Before you create one

Add the passkey while you can still sign in. Do not delete the password first. Start with email, then banking and shops that store a payment card. Email matters because it is the reset path for a lot of other accounts.

Decide where the key will live, and decide the spare route, before you tap save. A spare can be another device on the same synced account, a hardware key kept at home, or recovery codes stored somewhere other than that phone.

Do not put a private passkey on a shared family tablet. Anyone who knows that PIN can use it. Shared shop logins are a different job from a personal inbox. For the shared ones, Family Password Keeper: A Practical Guide to Securing Your Household is the more useful approach, and the private keys should stay off the communal device.

Button names change between brands and software versions. If you cannot see a passkey control, the device may need an update, or the site may not offer passkeys yet. In the account security settings, look for create a passkey or sign in with a passkey.

Set a passkey up on your phone

On a recent iPhone or iPad, passkeys usually save to Passwords in iCloud Keychain when Keychain is on and the device is signed in with your Apple Account. Open the website or its app, find the security or sign-in settings, create a passkey, and approve with Face ID, Touch ID or your passcode. Then open Settings, then Passwords, and confirm that the site is listed.

On an Android phone, the usual home is Google Password Manager for the Google account you actually use. The menus differ by manufacturer. Create the passkey from the site’s own security page, approve with the fingerprint, face check or screen lock you already use, then open the manager and check that the entry is there.

• Use a phone you control, not one you are about to sell, return or share.
• Open the site yourself. Do not start from an unexpected text or email.
• If the phone offers a choice of stores, pick the one your computer also uses, and note that choice.
• Where the site allows a second passkey, add one on another device or on a hardware key.
• Sign out, then sign in with the passkey, while the old password still works.

Set a passkey up on a computer

On a Mac, Safari can keep a passkey in the same iCloud Keychain as your iPhone, when both use the same Apple Account and Keychain is switched on. Chrome and other browsers may offer Keychain or a different manager. Read the name of the store before you agree.

On a Windows PC, set up Windows Hello first: a PIN, a fingerprint or face sign-in. In Edge or Chrome, open the account security page, create the passkey, and approve the Windows Hello prompt. Notice whether it will sync with your Microsoft account or stay on this PC. If the prompt does not say, treat it as this computer only until you have seen the same passkey on a second machine.

Linux setups differ. A browser may offer to store a passkey, and a password manager or a hardware key is often the practical route. If there is no prompt, that combination of browser and site cannot create one. It does not mean you have missed a hidden button.

Skip guest profiles, shared office computers, and browser profiles you are about to delete. A passkey saved there is either a risk to the account or a key you are about to throw away.

Sign in on another device

A computer that does not hold the passkey can often borrow the one on your phone. The site shows a QR code. Scan it with that phone, keep the phone nearby, and approve the usual unlock. Nearness is part of the check, often over Bluetooth, so a photo of the code forwarded to someone elsewhere should not be enough on its own.

This is a bridge, not a copy. The passkey has not moved onto the computer unless you also created one there, or your provider actually synced it. Next time, you may need the phone again.

If Bluetooth is off, the camera will not scan, or a work network blocks the check, use the password you still have. That is one reason not to remove the password in the same sitting. A hardware security key is the other way to sign in on different computers: plug it in or tap it, then enter its PIN if it asks. How many passkeys one key can hold depends on the model, so check with the maker rather than assuming a number. A key kept at home is a backup. The same key on your everyday keyring, with no second method, is a single point of failure.

When to keep a password

Keep the password, or some other method that is not this one passkey, whenever any of the following is true.

• The site has no passkey option. Use a unique password, plus an extra check that does not rely on text messages if the site offers one.
• The site still asks for the password before sensitive changes, such as a new email address or a view of the backup codes.
• Your only passkey is device-bound and you have no spare device. A lost phone would drop you into recovery you have never tried.
• Other people must sign in, for example a household shop account or a club login. A passkey on your phone will not travel with them. A shared password in a manager, limited to the right people, can be the practical fit.
• You may have to use a public or work computer that cannot talk to your phone. A unique password and an authenticator that is not only on that phone will carry you through the trip.
• A bank or an employer has told you which sign-in methods are allowed. Follow that instruction.

You can remove a password later if a second passkey has already worked, recovery codes are stored off the phone, and the site will clearly let you in without the password. If the site will not let you remove it, leave a unique password in your manager. Deleting it for its own sake does not make the account safer.

Recovery planning

Lockouts come from ordinary events: a dead phone, a wiped laptop, a failed security key, or a cloud account you cannot get through. Arrange the spare route while you still have a working sign-in.

Give each important account two ways in. A passkey on the phone plus a passkey on the computer is enough for many people. A hardware key that stays at home covers the harder case, where the synced account itself is the thing you cannot open.

If you are counting on sync, prove it. Create the passkey on the phone, then find that same entry on the laptop before you trust it. An entry you can see is stronger than a setting that only promises to copy keys later.

Store recovery codes, when the site provides them, somewhere other than the only phone. Paper in a sensible place at home works. So does a record inside a password manager you can open from a second device. Do not keep the only copy in the same place as the only key.

Protect the account that holds the passkeys. If they live in iCloud Keychain, Google Password Manager, a Microsoft account or another manager, losing that login can be worse than losing one handset. Give it backup codes and a second factor that is not the same phone, and try those methods once while you still remember the details.

When you change phones, sync or recreate the passkeys, sign in to email as a test, and only then wipe the old phone. If you stop using a password manager, move the passkeys out before that account closes. Twice a year, revoke passkeys for devices you no longer own, on the website as well as on the device. A laptop you have sold is still a key until the site forgets it.

If you are already locked out, use only that site’s own recovery. Have the recovery email, the phone number or the codes ready, and ignore anyone who claims they can bypass the provider for you. Once you are back in, add the missing second method the same day so one failure is not enough to shut you out again.

A sensible order of work

Do one account at a time, and make email the first if it is still on a password alone.

1. Sign in with the current password.
2. Create the passkey and note where it was saved.
3. Sign out, then sign in with the passkey.
4. Add a second passkey, or store the recovery codes away from that device.
5. On a second device, confirm the passkey is visible if you expected it to sync.
6. Remove the password only if the site allows it and the spare method has worked.

If something does not work

• There is no passkey option. Keep a unique password and look again in a few months. Support is still uneven.
• The prompt wants to save in the wrong place. Cancel, check which browser profile and which password manager are active, then try again.
• The QR code will not scan. Turn Bluetooth on, allow the camera, and bring the phone closer. If it still fails, use the password.
• A new phone shows no passkeys. Sign in to the same Apple, Google, Microsoft or manager account and wait for sync, or use recovery codes and create a fresh passkey. Do not erase the old phone first.
• You no longer have a device. Revoke its passkeys on each website. Do not assume a factory reset will happen before it leaves your hands.
• Someone else in the household cannot sign in. That is expected if the key is on your phone. Add a passkey on their device, or keep a shared password for accounts that are genuinely shared. Do not give them your device PIN.

FAQ

Is a passkey the same as two-factor authentication?

No. A two-factor check usually sits beside a password. A passkey can replace the password, using the device unlock as the sign that you are present and a signature as the sign that the right key is present. Keep the older check until the passkey works on a second device.

Does the website store my fingerprint or my face?

No. The fingerprint, face check or PIN unlocks the private key on your device. The site receives a signed proof for that login, not a copy of your biometric. A strong device PIN still matters: anyone who can unlock the phone can use the passkeys stored on it.

Can I give up my password manager?

Only if you have somewhere else to reach every remaining password and every passkey. Most people still need a manager for sites that have no passkey, and for recovery codes. If you do close one, move the passkeys first, then test an important sign-in from another device before the old account is gone.

What if my phone is lost or stolen?

Use a synced copy on another device, a second passkey, a hardware key, or the recovery codes. If you prepared none of those, you are left with the site’s own recovery, which can be slow and can fail. After you get back in, revoke the missing phone and add a spare method before anything else.

Do I still need passwords at all?

Yes. You need them on sites without passkeys, on accounts other people must open, and as a spare until a second passkey has been tested. Make each remaining password unique and keep it in a manager. There is no benefit in deleting a password that the site still uses for recovery.

What if the cloud service that syncs my passkeys is down?

A device that already has the passkey may still be able to sign in, while a brand-new device may not receive a copy until that service is back. This is why recovery codes, or a hardware key that does not depend on the same cloud account, belong in the plan. Sync is a convenience, not the only route home.

Sources

• National Cyber Security Centre: top tips for staying secure online

By subscribing you agree to receive email updates from busytechguy.com. We use Kit to send them. See our Privacy Policy. You can unsubscribe at any time.