Apple, Google, and Microsoft have all made a major bet: passwords are fundamentally broken, and passkeys are what replaces them. Major services including PayPal, Amazon, WhatsApp, GitHub, and hundreds more now support passkey sign-in. This guide explains exactly what they are and why security experts are excited about them.
The problem with passwords
Passwords have three fundamental weaknesses:
- People reuse them. When one site is breached, every account with the same password is compromised.
- People choose weak ones. "123456" and "password" remain the most common passwords year after year.
- They can be phished. A fake login page can capture your password, and you may never know.
Passkeys solve all three of these problems simultaneously.
What is a passkey?
A passkey is a cryptographic key pair that replaces your password. When you create an account with passkey support, your device generates two mathematically linked keys:
- Public key — stored on the website's server. Not secret. Even if the server is hacked, this key is useless without your private key.
- Private key — stored securely on your device (in the Secure Enclave on iPhones, Trusted Platform Module on Windows, etc.). Never leaves your device.
When you log in, the site sends a challenge. Your device signs it with your private key. The site verifies the signature using your public key. You're authenticated — without sending any secret over the internet.
How you authenticate with a passkey
Instead of typing a password, you authenticate using the same method you use to unlock your device:
- Face ID or Touch ID on iPhone/Mac
- Windows Hello (face, fingerprint, or PIN)
- Android fingerprint or screen lock
This is convenient — no password to type or remember — and highly secure, because your biometric data never leaves your device either.
Why passkeys are more secure than passwords
Passwords can be:
- ✗ Phished from fake websites
- ✗ Reused across multiple sites
- ✗ Guessed or brute-forced
- ✗ Stolen in server breaches
- ✗ Shared accidentally
Passkeys cannot be:
- ✓ Phished (bound to the real domain)
- ✓ Reused (unique per site)
- ✓ Guessed (cryptographic key)
- ✓ Stolen from servers (public key only)
- ✓ Accidentally shared
The phishing resistance is particularly important. A passkey is cryptographically bound to the domain it was created for. If you try to use it on a fake phishing site, it simply won't work — even if the fake site looks identical to the real one.
How passkeys sync across your devices
One concern about passkeys is: what if you lose your device? The answer is cloud sync:
- Apple — passkeys sync via iCloud Keychain across all your Apple devices, end-to-end encrypted.
- Google — passkeys sync via Google Password Manager across Android and Chrome on any OS.
- Windows — syncs via Microsoft account across Windows 11 devices.
- Password managers — 1Password, Bitwarden, and others now support passkeys with cross-platform sync.
The FIDO2/WebAuthn standard
Passkeys are based on the FIDO2 standard, developed by the FIDO Alliance (Apple, Google, Microsoft, Amazon, and others) and the W3C. The browser-facing API is called WebAuthn. This is an open standard — not proprietary to any single company — which is why it works across all major platforms and browsers.
The same standard powers hardware security keys like YubiKey. In fact, passkeys are essentially the software equivalent of a hardware key stored in your device's secure enclave.
Should you still use a password manager?
Yes — for now. While passkey adoption is growing rapidly, thousands of sites still require passwords. A password manager remains essential for those accounts. As more services add passkey support, your need for passwords will gradually decrease, but we are likely a few years away from most services supporting passkeys.
In the meantime: use a strong unique password for every account that doesn't support passkeys yet, and enable passkeys on every service that offers them.
How to start using passkeys today
- Check if a service supports passkeys at passkeys.directory — a community-maintained list.
- In your account settings, look for "Passkey," "Security Key," or "Sign in with biometrics."
- Follow the setup prompts — your device will create the passkey automatically.
- Test by signing out and signing back in using the passkey.
Services with passkey support include: Google, Apple, Microsoft, Amazon, PayPal, GitHub, Dropbox, WhatsApp, Coinbase, Adobe, eBay, and many more.
Frequently asked questions
Do passkeys replace two-factor authentication?
Passkeys inherently provide two factors: something you have (the device with the private key) and something you are (biometric) or know (device PIN). They technically satisfy multi-factor authentication requirements, though some high-security systems may still require additional factors.
What if someone steals my phone?
Your passkeys are protected by your device's screen lock. An attacker with your locked phone cannot use your passkeys without your face, fingerprint, or PIN. If they somehow access your device, they can use the passkeys — which is why a strong device passcode is still important.
Can passkeys be backed up?
Yes — cloud sync (iCloud Keychain, Google Password Manager) backs them up automatically. If you lose your device, you can restore passkeys on a new device using your account credentials and account recovery process.
Are passkeys available on all browsers?
Yes. Passkeys work in Safari, Chrome, Firefox, and Edge on all major operating systems. Support was finalized in 2023 and is now broadly available.