Passkeys replace passwords with cryptographic keys stored on your device. They can't be phished, can't be stolen in a data breach, and are easier to use than passwords. Here's how they work and where you can use them today.
Passkeys are the most significant change to authentication since passwords were invented. Backed by Apple, Google, Microsoft, and the FIDO Alliance, passkeys replace the password + 2FA combination with a single cryptographic credential that is simultaneously more secure and easier to use. As of 2026, passkeys are supported by Google, Apple, Microsoft, GitHub, PayPal, Best Buy, Walmart, Shopify, and hundreds of other major services. The transition away from passwords is underway — and understanding passkeys now puts you ahead of the curve.
How passkeys work: when you create a passkey for a site, your device generates a public/private key pair. The public key is stored on the site's server. The private key is stored in your device's secure enclave (a dedicated security chip in modern iPhones, Android phones, and computers) and never leaves your device. When you log in, the site sends a challenge, your device signs it with the private key (after verifying your identity via Face ID, Touch ID, or PIN), and the site verifies the signature with the public key. No password is ever transmitted or stored.
Why passkeys are more secure than passwords: they can't be phished (the private key never leaves your device, and the authentication is domain-bound — a fake site gets a signature it can't use); they can't be stolen in a data breach (the server only stores the public key, which is useless without the private key); they can't be guessed or brute-forced (cryptographic keys have effectively infinite entropy); and they're immune to credential stuffing (each passkey is unique to one site). The only way to compromise a passkey is to physically compromise the device that holds it.
Passkey sync and backup: passkeys are synced across your devices through your platform's credential manager — iCloud Keychain for Apple devices, Google Password Manager for Android/Chrome, and Windows Hello for Microsoft devices. This means if you create a passkey on your iPhone, you can use it on your iPad and Mac automatically. If you lose your phone, you can recover your passkeys from iCloud or Google backup. This sync is end-to-end encrypted — Apple and Google cannot read your passkeys.
Cross-platform passkeys: if you have a passkey on your iPhone and need to log in on a Windows computer, you can use your phone as an authenticator via QR code and Bluetooth proximity. The computer displays a QR code, you scan it with your phone, and your phone authenticates via Face ID and sends the signed challenge back to the computer. This cross-device flow works across all major platforms and browsers. Third-party password managers including 1Password and Bitwarden also support passkey storage, giving you platform-independent passkey management.
How to start using passkeys: on any supported site (Google, Apple ID, GitHub, PayPal, etc.), go to your account security settings and look for a 'Passkeys' or 'Security keys' option. Create a passkey — your device will prompt you to authenticate with Face ID, Touch ID, or your PIN. The passkey is created and synced to your other devices automatically. Next time you log in, you'll be prompted to use the passkey instead of your password. You don't need to delete your password immediately — passkeys and passwords can coexist during the transition. Start with your most important accounts and expand from there.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.