A passkey is a way of signing in to a website or app without typing a password. Instead of a secret you have to remember, your device holds a cryptographic key and unlocks it with something you already use every day: your fingerprint, your face, or your phone’s screen PIN. The UK’s National Cyber Security Centre (NCSC) now says plainly that people should “opt for passkeys over passwords wherever they are available.”
If you have been wondering whether passkeys are a fad, a gimmick, or the real thing, this guide explains what they are, how they work, what happens if you lose your phone, and where they still fall short.
In short
- A passkey is a login credential built on open FIDO standards. It replaces your password for the accounts that support it.
- The private half of the key stays on your device. The website only ever holds the public half.
- You approve a sign-in with a fingerprint, face scan or device PIN, and the NCSC says passkeys are resistant to phishing because they cannot be “intercepted, reused or stolen like passwords.”
- Passkeys are not available everywhere yet. Where they are not, the NCSC recommends strong passwords with two-step verification.
What is a passkey?
The FIDO Alliance, the industry body behind the standard, describes a passkey as an authentication credential based on FIDO standards. In everyday terms, it is a pair of linked digital keys. One is public and lives with the service you are signing in to. The other is private and never leaves your device.
You do not create or manage these keys by hand. Your phone, laptop or password manager does it for you, usually through a prompt that says something like “Create a passkey for this account?” The NCSC explains that passkeys are created and managed automatically by your device’s credential manager, the part of your phone, computer or password manager that stores your logins.
This is the key difference from a password. A password is a shared secret: you know it, and the website stores some form of it. If either side leaks it, or if you are tricked into typing it into a fake site, it can be used against you. A passkey contains no shared secret to leak.
How does signing in with a passkey actually work?
The process is short, and you will probably have done something similar when unlocking your phone.
- You go to a site that supports passkeys and choose to sign in.
- Your device asks you to prove it is you, with a fingerprint, face scan, PIN or pattern.
- Your device uses the private key to answer a challenge from the website.
- The website checks that answer against the public key it holds, and lets you in.
The FIDO Alliance stresses two details that matter for privacy. The biometric check happens locally on your device, so your fingerprint or face data is not sent to the website. And the website only receives confirmation that verification succeeded. It never sees your biometric data, and it never receives your private key.
Because each passkey is tied to the specific service it was created for, it also cannot be reused across sites. That removes one of the most common weaknesses of passwords, which is that people reuse them.
Why do security experts prefer passkeys to passwords?
The main argument is phishing. Phishing works by persuading you to hand over a secret, typically by getting you to type your password into a convincing fake page. A passkey is bound to the genuine service, so there is nothing useful to type into the wrong place, and nothing for a criminal to copy and reuse later. The NCSC calls passkeys “resistant to phishing” for exactly that reason.
The NCSC makes two further claims on its guidance page that are worth knowing, because they speak to the usual objection that stronger security means more hassle:
- Passkeys are “always as secure or more secure than 2SV”, the two-step verification many of us already use, where you enter a password and then a code.
- Sign-ins are “up to 8 times faster” than the traditional combination of username, password and two-step verification.
Treat the speed figure as the NCSC’s own comparison rather than a promise for every site. But the direction is clear: a passkey asks for less effort from you and gives an attacker less to work with. That combination is rare in security advice.
What happens if I lose my phone?
This is the question most people ask first, and it is a fair one. If your login lives on a device, what happens when the device disappears?
The answer depends on how your passkeys are stored, but the design intention is that you do not lose access. The NCSC notes that credential managers protect and back up passkeys and can sync them across your trusted devices, so you “shouldn’t completely lose access” if you lose one device. The FIDO Alliance describes two broad approaches:
- Synced passkeys. Passkeys are securely synced across your devices through a cloud service, such as Apple’s iCloud Keychain or Google Password Manager. If you replace a lost phone, setting up your account with the same provider on the new device restores your passkeys.
- Device-bound passkeys. These stay on one piece of hardware, such as a physical security key. The FIDO Alliance notes that such security keys can also act as a recovery credential if you lose access to your synced devices.
There is also a cross-device option. If you want to sign in on a computer that does not hold your passkey, FIDO’s cross-device authentication can use Bluetooth Low Energy to verify that your phone is physically nearby before approving the login.
What about the opposite problem, a thief with your phone? A passkey is only usable after the device verifies you with a biometric check or PIN, as the NCSC explains. That makes the strength of your phone’s own lock more important than it was before. A short, guessable screen PIN is now protecting more than your photos.
Who supports passkeys, and where do they not work yet?
Support is broad but not universal. The FIDO Alliance says major platform providers including Apple, Google and Microsoft support passkeys natively, as do password managers such as 1Password and Dashlane. Its 2024 survey found that 53% of people reported enabling passkeys on at least one account. That is a figure from an industry group’s own survey, and it reflects self-reported use, so it is best read as a sign of momentum rather than a precise measure of adoption.
The honest picture for most people is a mixed one. Your email, your phone’s app store and a growing list of retailers and banks may offer passkeys, while a smaller site, an older work system or a loyalty scheme may not. The NCSC is clear on this point: passkeys are “not universally supported yet,” and where they are unavailable you should use a strong password together with two-step verification.
How to start using passkeys: a practical checklist
You do not need to switch everything at once. A sensible approach is to move the accounts that matter most, then add others as the option appears.
- Start with your email and main cloud account. These are the keys to everything else, because they are used to reset other passwords.
- Accept the prompt when a site offers one. When a site asks whether to create a passkey, saying yes is usually the whole setup.
- Check where your passkeys are stored. Know whether they sync through your phone maker’s service or your password manager, so that you understand what restores them on a new device.
- Strengthen your device lock. Use a long PIN or password for your phone and computer, and keep biometrics enabled if you are comfortable with them.
- Keep account recovery options current. Make sure the recovery email or phone number on your important accounts is one you still control.
- Keep a strong password plus two-step verification on accounts that do not yet offer passkeys, as the NCSC advises.
- Consider a hardware security key for your most important accounts if you want a recovery option that does not depend on your phone.
If you are weighing whether an older handset can cope with all this, our guide to whether you actually need to upgrade your phone this year covers the broader question of when a new device is worth it.
What passkeys do not fix
Passkeys solve a specific and very common problem: stolen, guessed and phished passwords. They do not make every other risk disappear.
A passkey does not protect an account if someone gains full control of your unlocked device, and it cannot stop you from being persuaded to approve something you should not. Social engineering, where someone tricks you or a support agent into giving access, remains a risk on any system. And because the technology depends on your device and its credential manager, the usual hygiene still applies: keep your software updated and be careful about who has access to your phone.
There is also a practical trade-off in the choice of where to store your passkeys. Tying them to one company’s ecosystem is convenient, but it means switching ecosystems later takes some planning. Using a cross-platform password manager is one way some people reduce that dependence. As with any security decision, the right answer depends on how you use your devices.
It is also worth being realistic about the timeline. Passwords are not going away overnight. For the foreseeable future, most people will live with a mix of passkeys, passwords and two-step verification. The goal is not perfection but a steady reduction in the number of passwords you have to protect. As we have noted in our coverage of what AI agents can actually do today, software that acts on your behalf makes the question of who or what holds your credentials more important, not less.
Frequently asked questions
Do websites get a copy of my fingerprint or face?
No. The FIDO Alliance says the biometric check stays on your device, and the website only receives confirmation that verification succeeded.
Do I still need a password?
Sometimes. Passkeys are not universally supported, so many accounts still rely on passwords. The NCSC advises using strong passwords with two-step verification wherever passkeys are not an option.
Can I use the same passkey on more than one device?
Yes, if your passkeys are synced. Credential managers can sync passkeys across your trusted devices, as the NCSC explains, using services such as iCloud Keychain or Google Password Manager. Device-bound passkeys, such as those on a hardware security key, stay on that one device.
Are passkeys the same as using my fingerprint to log in?
Not quite. Your fingerprint or face is only the way you unlock the passkey on your device. The passkey itself is a cryptographic key pair, and your biometric data is not what gets sent to the website.
The bottom line
Passkeys are a genuine improvement rather than a rebrand. They remove the shared secret that makes passwords so easy to steal, they resist phishing, and they are usually quicker to use. The practical advice from the NCSC is simple: use them wherever they are offered, and keep strong passwords with two-step verification for everywhere else.
This article is general information, not personal security advice. Features, supported services and recovery options vary by device and provider, so check the instructions for your own accounts.
Sources: NCSC — Passkeys: what you need to know; FIDO Alliance — Passkeys.
