No Ticket Needed

Appearance

2 min fix 3 min read Recently reviewedBeginner

By , IT support technician

Quick Answer

Passkeys use your device's biometric sensor (fingerprint or face) or PIN instead of a password. They are phishing-resistant because they are tied to the legitimate website — a fake site cannot intercept them. Set up passkeys in your account's security settings.

Understanding Passkeys — What They Are and Why They're Replacing Passwords ​

Estimated Time to Fix: 2 minutes

Applies to: General Security, Microsoft 365, Google, Apple
Article Type: Informational
Last Updated: 2026-07-20

Summary ​

This article explains the concept of passkeys, how they improve security over traditional passwords, and what you need to know as websites transition to passwordless authentication.

Prerequisites ​

  • None required.

Instructions ​

1. What is a Passkey? ​

  1. A passkey is a digital credential that allows you to sign into an account without typing a password.
  2. Instead of a password you must remember, a passkey relies on the biometric security built into your devices, such as Apple's Face ID, Windows Hello, or your smartphone's fingerprint scanner.
  3. When you log in, your device proves your identity to the website mathematically. No password is ever transmitted over the internet.

2. Why Are Passwords Going Away? ​

  1. Passwords are fundamentally insecure. They can be guessed, stolen in data breaches, or intercepted through phishing websites.
  2. Passkeys are completely immune to phishing. Even if you are tricked into visiting a fake login page, the passkey will refuse to work because the website's mathematical signature won't match.
  3. Since there is no password to type, attackers cannot steal your credentials, significantly reducing corporate security risks.

3. How Does a Passkey Work? ​

  1. When you create a passkey, your device generates a unique cryptographic key pair: a "public key" (stored on the website) and a "private key" (stored securely on your device).
  2. To sign in, the website challenges your device to solve a math problem using the private key.
  3. Your device asks you to authorize the solution using your face or fingerprint. Once authorized, it sends the solution back, and you are logged in.

Troubleshooting ​

WARNING

Because passkeys rely on the physical device you used to create them, you should ensure your device is backing up its passkeys to a secure cloud manager (like iCloud Keychain or Google Password Manager) in case your phone is lost or broken.

Symptom / ErrorPotential CauseSolution
Does the website get a copy of my fingerprint?Privacy concernNo. Your biometric data never leaves your device. It is only used to unlock the private key stored locally on your phone or computer.
What happens if I lose my phone?Access lostIf your passkeys are synced to the cloud (e.g., Apple ID, Google Account), you can restore them on a new device. Otherwise, you can use account recovery methods or backup MFA options to regain access.