Passkeys are showing up everywhere: on Google, Apple, Microsoft, Amazon and many banking and shopping sites. They promise sign-ins with no password to remember and no code to type. Here is what is actually going on under the hood, in plain English.
What is a passkey?
The FIDO Alliance, the industry group behind the standard, defines a passkey as "an authentication credential based on FIDO standards" that you unlock "with the same process that they use to unlock their device (biometrics, PIN, or pattern)."
Technically, a passkey is a public/private key pair created for one specific website or app:
- The private key stays with you: on your phone, computer, password manager or a hardware security key.
- The public key is sent to the website and stored with your account. It is useless on its own.
Passkeys are built on the FIDO2 standards: WebAuthn (the browser API websites use) and CTAP (how browsers talk to authenticators like your phone or a security key).
What happens when you sign in
- The website sends your device a random challenge.
- Your device asks you to unlock it with your face, fingerprint or PIN.
- The private key signs the challenge. The key itself never leaves your device.
- The website checks the signature using the public key it stored when you registered. If it matches, you are in.
Because each challenge is random, a captured signature can't be replayed later. And because the passkey is tied to the website's real domain, your browser simply won't offer it to a look-alike phishing site.
Why passkeys beat passwords (and SMS codes)
The FIDO Alliance argues that a passkey on its own is "more secure than the combination of either 'password + OTP' or 'password + phone approval'" (FIDO). The reasons:
- Nothing to phish. There is no code or password you can be tricked into typing.
- Nothing worth stealing on the server. A breached database only leaks public keys.
- No reuse. Every passkey is unique to one site, so credential stuffing doesn't work.
Companies that adopted passkeys report big improvements. These are self-reported figures collected on the FIDO Alliance page, not independent tests:
The same page lists Amazon reporting 6x faster sign-ins and Google a 4x better sign-in success rate than passwords.
Synced vs device-bound passkeys
| Synced passkeys | Device-bound passkeys | |
|---|---|---|
| Where they live | Passkey provider (iCloud Keychain, Google Password Manager, 1Password, Dashlane…) | One device, typically a hardware security key |
| New phone? | Appear automatically after you sign in to the provider | Need the key itself, or register a new passkey |
| Best for | Most people, everyday accounts | High-security accounts, strict compliance |
FIDO says syncing is end-to-end encrypted, while device-bound passkeys on hardware security keys "offer the highest security assurance" (FIDO).
Signing in on someone else's computer
If the passkey isn't on the device in front of you, the sign-in page can show a QR code. Scan it with your phone, approve with your fingerprint, and you're in. This uses FIDO's cross-device flow (CTAP "hybrid"), which uses Bluetooth Low Energy only to confirm your phone is physically nearby; the actual data is protected by its own encryption layer.
How to start using passkeys
- Open the security settings of an important account (Google, Microsoft, Apple, Amazon, GitHub, your password manager).
- Choose Create a passkey and approve with your device unlock.
- Keep a recovery method: a second device, a backup security key, or your provider's account recovery.
- Once it works, consider removing SMS as a fallback where the service allows it.
Sources
- FIDO Alliance: Passkeys: Passwordless Authentication (checked October 22, 2026)
- W3C: Web Authentication (WebAuthn) specification
Frequently asked questions
Is a passkey just a password stored on my phone?
+
No. A passkey is a cryptographic key pair. Your device keeps the private key and the website stores only the public key, so there is no shared secret that can be typed into a fake site or leaked in a database breach.
Does the website get my fingerprint or face data?
+
No. According to the FIDO Alliance, biometric processing stays on your device and is never sent to the server; the site only learns that the check succeeded.
What happens if I lose my phone?
+
Synced passkeys are backed up by your passkey provider (for example iCloud Keychain, Google Password Manager or a third-party manager), so they reappear when you sign in on a new device. Device-bound passkeys on a security key are not synced, which is why a backup key or recovery method matters.
Can I use a passkey from my phone on a laptop?
+
Yes. With FIDO cross-device authentication, the laptop shows a QR code, you scan it with your phone, and Bluetooth is used to confirm the phone is physically nearby.
