A passkey is a FIDO cryptographic credential: a public/private key pair tied to one account on one website or app. You approve sign-in by unlocking your device.

How do passkeys stop phishing?

Passkeys are origin-bound, so a lookalike site cannot receive the credential the way a stolen password can be typed into a fake form.

Are passkeys synced across devices?

Many consumer passkeys sync through a credential manager such as iCloud Keychain or Google Password Manager. Device-bound passkeys stay on one authenticator.

Do I still need a password manager?

Yes for sites that do not support passkeys yet, and as a place that may also store synced passkeys and recovery codes.

What happens if I lose the device with my passkey?

Use a synced copy on another device, a backup hardware key, or the account's recovery flow. Add a second passkey before you need it.

What Are Passkeys? Passwordless Login Explained (2026)

Passkeys are the industry bet to kill the password — not another SMS code, not another manager vault you still have to type into a phishing page. They use the same Face ID / fingerprint / PIN flow you already use to unlock your phone, backed by public-key cryptography from the FIDO Alliance.

TL;DR - A passkey is a public/private key pair tied to one account on one site. - The private key stays on your device (or synced password manager); the site only stores the public key. - You approve sign-in with biometrics, PIN or pattern — no shared secret to phish. - Synced passkeys work across your devices; device-bound ones stay on one authenticator. - Keep a recovery path: second device, security key, or account recovery codes.

What is a passkey, in plain English?

According to the FIDO Alliance passkeys overview, a passkey is a FIDO credential you can store on a phone, computer or hardware security key. When a site asks you to sign in, you unlock your device the normal way. The device proves you hold the private key. The site never sees that private key, and you never type a reusable password into a web form.

MDN's passkeys guide puts the same idea in engineer language: the authenticator signs a challenge from the server; the server verifies the signature with the public key it stored at registration.

How passkeys work (registration + sign-in)

Registration

You are already signed in (or creating an account) and the site offers "Create a passkey".
Your device generates a unique key pair for that site only.
The private key stays in the platform authenticator or password manager; the public key is sent to the site.
You confirm with Face ID, fingerprint, PIN or a hardware key touch.

Sign-in

The site sends a random challenge to your browser or app.
You pick the account and unlock the device.
The authenticator signs the challenge with the private key.
The site checks the signature against the public key and lets you in.

Passkey Central notes an important detail: the passkey is origin-bound. A lookalike phishing domain cannot receive the credential the way a stolen password can.

Synced vs device-bound passkeys

Synced passkeys travel through iCloud Keychain, Google Password Manager or another credential manager so a new phone can keep working.
Device-bound passkeys live on one authenticator (often a YubiKey-style security key). Lose the key, recover another way.

Most consumer accounts in 2026 default to synced passkeys because people replace phones. High-security roles may still prefer a hardware key.

Why passkeys beat passwords (and most 2FA)

Phishing resistance: there is nothing useful to type into a fake site.
No shared secret dump: a breached server only has public keys.
Built-in second factor: possession of the device plus biometric/PIN.
Less reuse: every site gets its own key pair automatically.

SMS one-time codes still help against password reuse, but they fail against SIM-swap and phishing kits that relay codes in real time. Passkeys are designed for that threat model.

How to set up a passkey today

On Google, Apple, Microsoft or any major site, open Security / Sign-in settings.
Choose Create passkey / Add passkey and follow the device prompt.
Confirm the passkey appears in your password manager or OS settings.
Add a second passkey on another device or a hardware security key.
Store recovery codes offline if the account still offers them.

For a wider hardening pass after you move off passwords, see our startup cybersecurity checklist and the overview of AI cybersecurity threats businesses need to watch.

Limitations you should plan for

Not every site supports passkeys yet — keep a password manager for the long tail.
Shared family computers need care: a synced passkey can unlock accounts for whoever can unlock the device.
Account recovery after total device loss still depends on the site's fallback process.

FAQ

Are passkeys the same as Face ID?

No. Face ID / fingerprint unlocks the private key on your device. The passkey is the cryptographic credential the website verifies.

Can someone steal my passkey by phishing?

They cannot trick you into typing it. A fake domain will not receive the real origin-bound credential. Device malware is still a separate risk — keep your OS updated.

What if I lose my phone?

If the passkey was synced, sign in on another trusted device and remove the lost one. If it was device-bound only, use the account's recovery options or a backup security key.

Source: FIDO Alliance — Passkeys. Also referenced: MDN Passkeys, Passkey Central — How Passkeys Work.