No Ticket Needed

Appearance

Understanding Passkeys: What They Are and How They Work

Applies toGeneral Security, Microsoft 365, Google, Apple
3 min read Updated 7 Aug 2026

By , IT support technician How these guides are checked

Checked against Microsoft Learn — end of support and retirement and Google Chrome Releases between 5 Aug 2026 and 24 Aug 2026. Nothing published in that period has been linked to this guide.

Quick Answer

Passkeys use your device's biometric sensor (fingerprint or face) or PIN instead of a password. They are phishing-resistant because they are tied to the legitimate website — a fake site cannot intercept them. Set up passkeys in your account's security settings.

Estimated Time to Fix: 2 minutes

Summary ​

This article explains the concept of passkeys, how they improve security over traditional passwords, and what you need to know as websites transition to passwordless authentication.

Before You Start ​

  • None required.

Instructions ​

1. What is a Passkey? ​

  1. A passkey is a digital credential that allows you to sign into an account without typing a password.
  2. Instead of a password you must remember, a passkey relies on the biometric security built into your devices, such as Apple's Face ID, Windows Hello, or your smartphone's fingerprint scanner.
  3. When you log in, your device proves your identity to the website mathematically. No password is ever transmitted over the internet.

2. Why Are Passwords Going Away? ​

  1. Passwords are fundamentally insecure. They can be guessed, stolen in data breaches, or intercepted through phishing websites — the kind you can learn to spot in how to identify a phishing email.
  2. Passkeys are completely immune to phishing. Even if you are tricked into visiting a fake login page, the passkey will refuse to work because the website's mathematical signature won't match.
  3. Since there is no password to type, attackers cannot steal your credentials, significantly reducing corporate security risks.
  4. Passwords are going, not gone. Most accounts still need one today, so it is worth knowing how to create and use strong passwords while the change works through.

3. How Does a Passkey Work? ​

  1. When you create a passkey, your device generates a unique cryptographic key pair: a "public key" (stored on the website) and a "private key" (stored securely on your device).
  2. To sign in, the website challenges your device to solve a math problem using the private key.
  3. Your device asks you to authorize the solution using your face or fingerprint. Once authorized, it sends the solution back, and you are logged in.

Ready to create one? Setting up passkeys on your phone and browser walks through it on a real account, and passkeys in Microsoft 365 covers your work sign-in.

Troubleshooting ​

WARNING

Because passkeys rely on the physical device you used to create them, you should ensure your device is backing up its passkeys to a secure cloud manager (like iCloud Keychain or Google Password Manager) in case your phone is lost or broken.

Symptom / ErrorPotential CauseSolution
Does the website get a copy of my fingerprint?Privacy concernNo. Your biometric data never leaves your device. It is only used to unlock the private key stored locally on your phone or computer.
What happens if I lose my phone?Access lostIf your passkeys are synced to the cloud (e.g., Apple ID, Google Account), you can restore them on a new device. Otherwise, you can use account recovery methods or backup MFA options to regain access.

Last updated:

Frequently asked questions

What happens if someone steals my laptop? Can they use my passkey?
No. The passkey is locked behind your biometric data (Face ID/Fingerprint) or your Windows Hello PIN. A thief would need your laptop AND your fingerprint to log in.
How are passkeys safer than a strong password?
Passwords can be guessed, stolen in a database breach, or given away to a phishing website. Passkeys are physically tied to your device and use cryptography. They cannot be phished because there is no 'password' to type.