Your phone keeps asking if you want to “create a passkey”. Maybe you tapped “Not now” and moved on. So what are passkeys, and should you actually say yes? In most cases, we think you should.
Here’s the plain-English version, plus how to set them up on the accounts that matter most.
What are passkeys, in plain English?
A passkey is a sign-in that replaces your password. Instead of typing something you memorized, you unlock with your face, fingerprint or phone PIN. The FIDO Alliance describes it as signing in to apps and websites the same way you unlock your device.
Think of a password as a secret knock. Anyone who overhears it can knock the same way. A passkey, on the other hand, works more like a key that never leaves your pocket.
How passkeys work behind the scenes
Each passkey is really a pair of cryptographic keys. The website stores the public half. Meanwhile, your device keeps the private half locked up.
When you sign in, your device proves it holds the private key without ever sending it. As a result, there’s no password sitting on the company’s server waiting to be stolen in a breach.
Where your passkeys live
Passkeys are stored by a “passkey provider”. That’s usually Apple, Google, Microsoft or a password manager. According to FIDO, a passkey you create on one device syncs to your other devices that use the same provider.
So when friends ask us, “What are passkeys, really?” we keep it simple. They’re keys your devices carry for you, backed up by the account you already use.
Why passkeys beat passwords
- They resist phishing. A passkey only works on the real website it was made for. So a fake login page can’t trick it.
- Nothing to reuse. Every passkey is unique, so one breached site can’t unlock your others.
- Nothing to forget. Your face or fingerprint does the work.
- Private biometrics. Google says your fingerprint and face data stay on your device and aren’t shared with Google.
That phishing point is the big one. Fake login pages are how most people lose email accounts. For that reason, passkeys close a door that even text-message codes leave cracked open.
How to set up passkeys on your phone
First, make sure your phone has a screen lock. Passkeys depend on it, because the lock is what protects them.
On iPhone
Apple stores passkeys in iCloud Keychain, which it says is end-to-end encrypted. Starting with iOS 18, you can view them in the Passwords app. When a site offers a passkey, just approve it with Face ID or Touch ID. After that, it syncs to your other Apple devices.
On Android
Android phones save passkeys to Google Password Manager by default. Google lists Android 9 or later as the requirement. Similarly, you approve each sign-in with your fingerprint, face or screen lock.
Start with these three accounts
Don’t try to convert 200 logins in one evening. Instead, begin where a break-in would hurt the most. Your email account comes first, because it can reset almost everything else.
- Google Account. Go to myaccount.google.com/signinoptions/passkeys and choose Create a passkey. Then unlock your device when asked.
- Microsoft account. Sign in to Advanced security options at account.live.com/proofs/manage. Next, choose Add a new way to sign in or verify, then Face, Fingerprint, PIN, or Security Key.
- Your bank or shopping accounts. Look in each account’s security or login settings for a passkey option.
Microsoft’s own passkey setup guide covers the details. Keep in mind that menu names shift over time, so follow the on-screen prompts if a label looks different.
What are passkeys bad at?
Here’s our honest pushback: passkeys are great, but they aren’t magic. Knowing the limits up front helps you avoid a lockout. There are a few catches worth knowing.
- Your phone lock becomes the front door. A four-digit PIN that your kids know is a weak lock.
- Your Apple or Google account becomes the vault. Protect it with strong recovery options and multi-factor sign-in.
- Mixed households get tricky. An iPhone user with a Windows PC may need to scan a QR code to sign in.
- Not every site supports them yet. So you’ll still need a password manager for the rest.
If you lose a phone, don’t panic. Google recommends signing in from another device and removing the lost phone’s passkey. Then create a fresh one on the replacement.
Passkeys, MFA and your family plan
Passkeys don’t make everything else obsolete. For accounts without passkey support, keep using multi-factor authentication. Our guide to multi-factor authentication for small businesses explains the options in plain English.
There’s also an estate-planning angle. Passkeys live on your devices, so your family may need a way in someday. Our post on passwords in your will covers how to plan for that.
Running a business? Add passkeys to the login section of our 30-minute small business security checklist. They fit right alongside MFA and password managers.
So, what are passkeys worth to you?
If someone asks, “What are passkeys?” you now have the answer. In short, they’re faster than passwords and much harder to phish. Next time your phone offers one, tap yes. Then protect your phone lock and your Apple or Google account like the keys to the house.
Want help moving your family or office to passkeys without locking anyone out? Contact I am Geek for a free security consultation, and we’ll build a plan that fits the devices you actually use.