Passkeys: how to sign in to your accounts without a password

Passwords are the weak link in digital security: we reuse them across sites, forget them, write them down and fall for fake pages that steal them. Passkeys are the standard that major tech companies have been adopting to replace passwords, and they already work on many popular services.

What a passkey is

It's a digital credential your device creates for a specific website or app. It relies on public-key cryptography, through an open standard developed by the FIDO Alliance and the W3C (WebAuthn):

• A private key stays on your device, or in the password manager you use, and is never sent to the website.
• A public key is stored by the service.

When you sign in, the site sends a challenge, your device signs it with the private key and the site checks the signature with the public key. To release the key you do what you always do to unlock your device: fingerprint, face recognition or PIN.

Why it's safer

• Phishing-resistant: a passkey is tied to the site's real address. On a fake page it simply doesn't work.
• Nothing useful to leak: since the server only stores the public key, a breach at the site doesn't hand over anything that lets someone into your account.
• No reuse: every site gets a different key, generated automatically.
• Your biometrics never leave the device: your fingerprint or face only unlocks the key locally; the site never receives that data.

How to turn it on

The path varies from service to service, but it is usually similar:

1. Sign in normally and open your security or sign-in settings.
2. Look for "Passkey" or "Sign in without a password".
3. Confirm with your device's screen unlock. Next time you sign in, the site will offer the passkey.

Google, Apple and Microsoft accounts, along with many online stores, social networks and financial services, already offer the option.

Across devices

Passkeys can be synced through your platform account (such as Google or Apple) or by password managers, so they are available on your other devices. You can also use your phone to sign in on a computer that doesn't have your passkey: the site shows a QR code, you scan it with your phone and confirm there.

Things to keep in mind

• Protect your device unlock. Anyone who can unlock your phone can use your passkeys; use a strong PIN and don't share it.
• Keep a recovery method. Up-to-date email and phone number and, if the service offers them, recovery codes stored somewhere safe.
• Your password may still exist. Many services keep the password as a fallback. If so, make sure it is strong and unique.

Passkeys don't solve everything, but they close the two biggest doors to account takeovers: weak or reused passwords and fake login pages.