What a passkey is
A passkey is the alternative to a password: you log in with your fingerprint, your face or your phone's PIN, and there's nothing to type that someone can steal with a fake link.
- What it is
- Password replacement
- Since
- 2022
- Verdict
- Yes, but…
What it is
A passkey is a pair of cryptographic keys created when you turn on passwordless access for a website or app: one half stays on your device (or in your synced keychain), the other is given to the website. To log in, you just confirm it's you with your fingerprint, your face or your phone's PIN; there's no password to type and no code to copy.
Passkeys use the FIDO2 and WebAuthn standards, the same ones that have been powering physical security keys for years.
Since when
On May 5, 2022, the FIDO Alliance announced that Apple, Google and Microsoft had committed to expanding passkey support across their systems. Apple launched them with iOS 16, available from September 12, 2022. Google and Microsoft added support progressively through 2022 and 2023.
Why it's used
There's no password to leak in a data breach and no phishing link that works, because the passkey checks the real domain before responding. For anyone who turns it on, logging in is faster than with a password and 2FA combined.
The flip side: a passkey lives on a device or in a keychain that syncs across devices (iCloud, Google's password manager, or your own password manager if it supports it). If it isn't synced and you lose that specific phone, that passkey stays there, with no way to recover it from anywhere else. If it is synced, you recover it through your Apple or Google account, so that account becomes the piece that truly can't fail. Switching systems (from iPhone to Android, or the other way around) is where this shows up most clearly: one keychain doesn't talk to the other yet.
Do we use it?
Yes, if they're synced in a keychain or you have another way to log in that doesn't depend on that phone. Without that, a passkey tied to a single device is as fragile as the phone that holds it.
Check this
- Do you know if your passkeys are synced (iCloud, Google) or only live on this phone?
- Do you have another way into that account if you don't have your phone with you?
- Do you know what would happen to your passkeys if you switched from iPhone to Android or back?
Official sources: FIDO Alliance · Apple: using passkeys