THE USEFUL BIT

Passkeys Explained: How to Sign In Without a Password

Passwords can be a headache. You need to remember them, keep them different for every account and avoid falling for fake login pages designed to steal them.

Now there's another option: passkeys.

A passkey lets you sign in to a supported website or app using your device's fingerprint, face recognition, screen lock or another supported authentication method. There is no password to type each time.

It might sound complicated, but using one can be surprisingly simple.

What exactly is a passkey?

A passkey is a digital credential created for a particular account. Instead of sending a password to a website, your device or password manager uses cryptographic keys to prove that you are allowed to sign in.

The website stores a public key. The matching private key stays protected by your device or credential manager.

When you sign in, you approve the request using a method such as your fingerprint, face recognition or device PIN. Your fingerprint or face data is not sent to the website as part of the sign-in.

Because passkeys are tied to the website or app they were created for, they are designed to resist phishing attacks that trick people into entering passwords on fake websites.

Why are passkeys becoming popular?

Passkeys are gaining support across major technology platforms.

In May 2026, the FIDO Alliance estimated that five billion passkeys were in active use worldwide. Its research across 10 countries found that 75% of surveyed consumers had enabled a passkey on at least one account, while 49% said they used passkeys regularly when available.

Google also published updated guidance on creating passkeys for Google Accounts in October 2026.

These developments show that passkeys are moving beyond an experimental feature. However, not every website or app supports them yet, and many accounts still offer passwords as a fallback.

Are passkeys safer than passwords?

They offer important security advantages.

They are designed to resist phishing. A passkey is linked to the website or service for which it was created. This makes it much harder for a fake website to trick you into using that credential on the wrong site.

You don't have to remember another password. Your device or credential manager handles the credential, and you approve sign-in using a method you already use to unlock your device.

The website doesn't receive your private key. The sign-in process uses cryptographic proof rather than sending the private key to the service.

But passkeys are not a magic shield. Someone who can unlock your device may be able to access accounts associated with its passkeys. Malware, account recovery weaknesses and compromised devices can still create risks.

Keep your device secure and pay attention to unexpected sign-in prompts.

How to set up a passkey for your Google Account

If you use Gmail or YouTube, your Google Account is a practical place to start.

  1. Visit Google's official passkey settings.
  2. Sign in and verify your identity if prompted.
  3. Select the option to create a passkey.
  4. Follow the instructions on your device.
  5. Unlock your device using the method requested and complete the setup.

Depending on your device and settings, the passkey may be saved to your device or a supported credential manager.

Google recommends creating passkeys only on devices you personally own and use. Do not create one on a shared computer simply because the option appears.

For more details, read Google's official passkey guide.

How to use passkeys on an iPhone

On an iPhone, passkeys can be saved and managed through Apple's Passwords app and iCloud Keychain when the necessary settings are enabled.

To get started:

  1. Make sure your iPhone is updated and iCloud Keychain is enabled.
  2. Visit a website or app that supports passkeys.
  3. Sign in or create an account as usual.
  4. If the service offers to create a passkey, follow the on-screen instructions.
  5. Approve the request using the method your iPhone supports.

Your passkeys can be available on other approved Apple devices signed in to the same Apple Account when syncing is enabled.

For the exact steps, visit Apple's guide to using passkeys on iPhone.

What about Microsoft accounts?

Microsoft also supports passkeys for personal and work or school accounts, although available sign-in methods can depend on the account and the organisation's settings.

To explore the feature, visit Microsoft's passkey guide.

When a supported service offers to create a passkey, follow its official instructions and confirm where the credential will be saved.

What happens if you lose your phone?

This is the question you should answer before relying on passkeys for important accounts.

The recovery process depends on where your passkey is stored. Some passkeys sync through a credential manager to your other approved devices. Others may be tied to a particular device or security key.

Before creating one, check that you understand how to recover your account if your phone is lost, stolen or damaged.

Here are a few sensible precautions:

  • Keep your account recovery email and phone number up to date.
  • Make sure you can access your credential manager on another trusted device where supported.
  • Keep another approved sign-in method available if the service offers one.
  • Remove the passkey associated with a lost device when necessary.
  • Never share device unlock codes or account recovery codes with someone who contacts you unexpectedly.

Do not remove your only working sign-in method until you have confirmed that your alternative works.

Should you stop using passwords completely?

Not immediately.

Some websites do not support passkeys, and you may still need passwords for those accounts. Passkeys also depend on the devices and credential managers you use, so it is worth understanding the recovery process before changing how you sign in.

Start with an important account that supports passkeys, test the sign-in process and confirm that you can recover access if needed.

Once you are comfortable, you can enable passkeys on other supported accounts.

The takeaway

Passkeys offer a simpler way to sign in and provide stronger protection against many phishing attacks. They let your device or credential manager handle a digital credential instead of asking you to remember another password.

They still require sensible account security and a recovery plan, but they are worth learning about as more websites and apps adopt them.

The future of signing in may involve remembering less and protecting your accounts better. Passkeys are one important step in that direction.

Sources and further reading

Passkey availability and setup steps vary by service, device and operating system. Check the official guidance for your account before changing your sign-in settings.

✳
Keep your curiosity going.

Good information should help you ask better questions, not stop asking them.

FILED UNDERpasskeyspasswordless logininternet securityGoogle AccountAppleMicrosoftonline privacyaccount security