What Is a Passkey? Why It May Finally Kill Passwords
Learn how passkeys work in 2026: see why they stop phishing, what happens if you lose your phone, and how to add two passkeys safely on every account.
There is a good chance you have already used a passkey without noticing. You tapped "Sign in with Face ID", your phone did something in about a second, and you were in. No password. No code. No "check your email for a magic link."
That was a passkey. It has been shipping quietly for a few years now, and it is the first serious attempt in three decades to get rid of the password entirely. Not replace it with a better password. Get rid of it.
The reason it might actually work this time is that passkeys solve the problem passwords cannot: there is no shared secret. Nothing you know, nothing you type, and nothing for a fake login page to capture.
How a passkey actually works
A passkey is a cryptographic key pair. Two mathematically linked numbers. One is private and never leaves your device. The other is public and gets stored on the server you are signing in to.
When you sign in, the server sends a random challenge. Your device signs it with the private key and sends the signature back. The server checks the signature against the public key it stored. If it matches, you are in.
Three things follow from this that are worth sitting with:
- Nothing secret is transmitted. The private key never leaves your device, not even to the site you are logging into. There is nothing on the wire to intercept.
- Nothing is typed. There is no password to phish, no code to read out to a fake support agent, and no one-time code to relay in real time.
- The passkey is bound to a specific website. A passkey created for yourbank.com will refuse to authenticate on yourbank-secure-login.com. It cannot be tricked into working on the wrong domain, because the domain is baked into the credential.
Where your passkey actually lives
This is where it gets practical, and where the marketing usually gets vague.
A passkey lives in a secure enclave on your device: the Secure Enclave on an iPhone or Mac, the Titan security chip on a Pixel, the equivalent on a Windows machine with a TPM. It is protected by your device passcode, your fingerprint, or your face.
You can also store passkeys in a password manager and sync them across devices. iCloud Keychain does this for Apple devices. Google Password Manager does it for Android and Chrome. 1Password, Dashlane and Bitwarden all support passkeys now.
Syncing matters a lot, and it is the part that decides whether passkeys are convenient or annoying:
| Where the passkey lives | Syncs across devices? | Works cross-platform? |
|---|---|---|
| iCloud Keychain | Yes, across Apple devices | Only via QR code scan from a non-Apple device |
| Google Password Manager | Yes, across Android and Chrome | Yes, via Chrome on any platform |
| Windows Hello | Within the same PC | No |
| 1Password / Bitwarden / Dashlane | Yes, on every platform | Yes, on every platform |
| Hardware key (YubiKey) | No, it is physical | Yes, on every platform with a USB or NFC port |
What happens when you lose your phone
This is the question everyone asks, and it deserves a straight answer rather than a reassuring one.
If your passkeys are synced through iCloud Keychain or Google Password Manager, losing the phone is not a disaster. Buy a new phone, sign in to the same Apple or Google account, and the passkeys come back. This is genuinely how it works, and it is a better recovery story than most people expect.
If your passkey was device-bound, meaning it lived only in that phone secure enclave and was never synced, then losing the phone loses the passkey. Which is fine, because every service that supports passkeys also supports adding more than one. Add a passkey on your laptop as well as your phone. Then losing either one leaves you still able to sign in.
What you should not do is rely on a single passkey on a single device with no backup. That is the equivalent of having one key to your house and no spare. It is fine until it is not.
So why does every site still ask for a password?
Because passkeys are hard to build and the recovery story is genuinely unsolved for some businesses.
The technical side is mostly done. WebAuthn is a standard, browsers support it, and the platform APIs are stable. What is not done is the policy question: what does a bank do when a customer calls up and says "I lost my phone, I do not have my laptop, I do not remember my Apple ID password, and I need to get into my account today"?
With a password, the answer is a reset flow. With a passkey, the answer is a support queue and an identity verification process. That is expensive, slow, and opens a social engineering hole that the passkey was supposed to close.
This is the honest state of play in 2026. Passkeys are clearly better. The reason they have not replaced passwords everywhere is not technical resistance. It is that account recovery is a harder problem than authentication, and most organisations have not solved it yet.
Should you switch?
Yes, on the accounts that offer it, with two caveats.
Enable passkeys where you can, and keep the password as a fallback if the service allows it. Google, Apple, Microsoft, GitHub, Amazon and a growing list of banks and retailers all support passkeys now. Adding one takes about twenty seconds per account, and it does not disable your password unless you tell it to.
The two caveats:
- Do not delete your password until you have added at least two passkeys on two different devices. A single passkey on a single device is a single point of failure.
- Make sure the account recovery email and phone number are current. If you do lose everything, recovery is your only way back in, and it runs through whatever contact details the service has on file.
Does this replace two-factor authentication?
A passkey is already multi-factor, in a sense, because it requires something you have (the device holding the private key) plus something you are or know (your fingerprint, face or device passcode). Unlocking your phone to use a passkey is two factors in one gesture.
In practice, that means you can usually turn off SMS 2FA on accounts where you have enabled a passkey, because the passkey is stronger than the SMS code was. Some services do this automatically. Others leave both on, which is annoying but harmless.
What you should not do is turn off two-factor authentication on an account where you have not yet set up a passkey. That is strictly worse than where you started.
The bottom line
Passkeys are the first real replacement for the password that has actually shipped at scale, and they work by removing the thing that made passwords fragile: the shared secret. There is nothing to type, nothing to intercept, and nothing a fake login page can steal.
Add them where you can, add two per account, and keep your recovery details current. That is the entire strategy.
Tools mentioned in this article
Frequently asked
What is a passkey in simple terms?
A passkey is a replacement for a password that uses a cryptographic key stored on your device instead of a string you type. When you sign in, you unlock your device with your face, fingerprint or PIN, and the device proves to the website that it holds the correct key. Nothing secret is ever typed or transmitted.
Are passkeys safer than passwords?
Yes, substantially. There is no shared secret to steal, nothing to phish, and nothing to reuse across sites. A passkey is also bound to a specific domain, so a fake login page cannot capture it. The main risk that remains is account recovery, not the passkey itself.
What happens if I lose my phone with my passkeys on it?
If your passkeys sync through iCloud Keychain or Google Password Manager, sign in to the same account on a new phone and they come back. If they were device-bound, you use a second passkey you added elsewhere, or the account recovery flow. This is why you should add at least two passkeys per account.
Do passkeys work across iPhone and Android?
Yes, with caveats. Passkeys stored in a password manager like 1Password or Bitwarden work on both. iCloud Keychain passkeys can be used on a non-Apple device by scanning a QR code, but they do not sync into Android. Google Password Manager passkeys work anywhere you can run Chrome.
Can I use passkeys without a password manager?
Yes. Your phone and laptop can store passkeys natively without any third-party app. A password manager helps if you want them synced across platforms, or if you want them all in one place alongside your passwords and 2FA codes.
Why do some sites still require a password?
Because account recovery is hard. With a password, a user who loses everything can reset. With a passkey, the service has to verify identity some other way, which costs money and opens a social engineering hole. Many organisations have simply not solved that problem yet.
Are passkeys the same as two-factor authentication?
Similar in effect, different in mechanism. A passkey combines something you have (the device) with something you are or know (your biometrics or device passcode). In practice you can usually turn off SMS 2FA once a passkey is set up, because the passkey is stronger.
Can a passkey be phished?
No, not in the usual sense. A passkey is cryptographically bound to a specific domain. If an attacker sets up a fake login page, the passkey will simply refuse to authenticate, because the domain does not match. This is the main reason security researchers are so enthusiastic about them.
Should I delete my password after adding a passkey?
Only after you have added at least two passkeys on two different devices and verified the recovery email and phone number on the account. A single passkey on a single device is a single point of failure, and removing the password at that point makes things worse, not better.