Passkeys vs passwords: what changes, and what to do now

A passkey is a way to sign in without typing a password. You approve the sign-in with the same face scan, fingerprint, or PIN you use to unlock your device. Passkeys cannot be guessed, reused, or typed into a fake website, so they resist the tricks that steal passwords. Set one up now for your most important accounts, and keep a strong password plus a second step wherever a site does not offer passkeys.

What a passkey is

The FIDO Alliance, the industry group behind the standard, defines a passkey as “an authentication credential based on FIDO standards.” It can live on your phone or computer, or on a hardware security key. You sign in “with the same process that they use to unlock their device,” such as biometrics, a PIN, or a pattern. Biometrics are body-based checks like a fingerprint. FIDO says this data stays on your device and is never sent to a remote server.

Here is how it works, in plain words:

• When you create a passkey, your device makes a pair of linked keys for that one account. Microsoft says: “Instead of sending a password over the Internet, your device generates a pair of keys.”
• Apple explains that one key is public and is stored on the website’s server. The other is private. Apple says “the server never learns what the private key is.”
• To sign in, you unlock your device. The device then proves it holds the private key. No password crosses the internet.

Apple says passkeys are built on the WebAuthn standard, which uses public key cryptography. FIDO says its standards provide “phishing-resistant authentication.” Phishing is a trick that gets you to type your password into a fake site. Microsoft says a passkey is tied to the site it was created for, so your device will not offer it to a lookalike.

Passkeys vs passwords

	Password	Passkey
What you do	Type something you remember	Unlock your device
Unique to each site	Only if you make it so	Yes, made by your device for each account
Can be reused on many sites	Yes	No
Can be typed into a fake site	Yes	Designed to resist this
What the site stores	Your password, or a scrambled copy	A public key only
If the site is breached	Your password may leak	FIDO says there are “no passwords to steal”

Apple says passkeys are “uniquely generated for every account by your own device and are less vulnerable to phishing.” FIDO adds that passkeys can replace older steps such as a password plus a text-message code.

Synced or device-bound

Passkeys come in two kinds. FIDO calls them synced passkeys and device-bound passkeys.

• Synced passkeys are saved in a credential manager, which is a tool that stores your sign-ins, such as iCloud Keychain or Google Password Manager. They appear on all your devices that use the same account. FIDO says syncing is end-to-end encrypted. Apple says iCloud Keychain is end-to-end encrypted with keys “not known to Apple.”
• Device-bound passkeys never leave one device, such as a security key. Microsoft says: “If you lose the device, you lose the passkey unless you have another recovery method.”

Who supports them

FIDO says passkeys are supported in all major operating systems and browsers. Here is what the big account providers say:

• Apple: Passkeys work with iCloud Keychain, and they are stored in the Passwords app on your iPhone. To use them, iCloud Keychain and two-factor authentication must be on.
• Google: Google says passkeys need a supported device and browser, such as Windows 10 or later, a phone with Android 9 or iOS 16 or later, or a FIDO2 security key.
• Microsoft: Microsoft lets you create a passkey for a Microsoft account and save it to a credential manager, a phone, a security key, or Windows Hello.

Sites are still catching up. Apple says that if you do not see a passkey option, the site or app does not support passkeys yet.

How common are passkeys?

On May 7, 2026, the FIDO Alliance reported results from a survey of 11,000 consumers in ten countries. It found that 75% had enabled a passkey on at least one account. The survey was fielded by Sapio Research in April 2026, with a margin of error of 0.9 points. FIDO also reported that 90% of people were aware of passkeys and that 49% use them regularly when available. On October 15, 2026, FIDO estimated that 7 billion passkeys are in use worldwide. It also said more than a third of successful sign-ins now use a passkey, in an index built on data from 15 major consumer services.

Treat these numbers with care. The FIDO Alliance promotes passkeys and has a stake in their adoption. The survey was one it commissioned, and its post does not explain how the “7 billion” estimate was made. The survey covers ten countries, not only the United States.

How to create a passkey

The steps vary by site, but they look alike.

1. Google Account. Go to myaccount.google.com/signinoptions/passkeys. Choose to create a passkey, then unlock your device when asked. Google advises creating passkeys only on devices you own, because anyone who can unlock the device can get into the account.
2. Apple devices. When a site or app offers to save a passkey, tap Continue. Apple says it is saved to your iPhone’s Passwords app and to iCloud Keychain, and that you can keep a password and a passkey for the same account.
3. Microsoft account. Sign in to your Advanced Security Options page at account.live.com/proofs/manage. Choose “Add a new way to sign in or verify,” then “Face, Fingerprint, PIN, or Security Key,” and follow your device’s prompts. You can pick where to save it.
4. Other sites. Open the site’s security settings and look for “passkey.” Test the new sign-in before you rely on it.

What if you lose your phone?

Plan for this before it happens.

• Apple: Apple says passkeys in iCloud Keychain “are recoverable even if the user loses all their devices.” Recovery needs your iCloud account and password, a text-message response, and your device passcode. Apple allows only 10 attempts, and it says the recovery record is destroyed after the tenth failed one. You can also set up an account recovery contact.
• Microsoft: Microsoft advises saving passkeys to a synced credential manager when possible. If you save a passkey on one device, create passkeys on your other devices too, as a “digital spare key.”
• All accounts: Keep your recovery email address and phone number current. The FTC says to make sure they are ones you entered and still have access to.

Do you still need passwords?

Yes, for now. Many sites do not offer passkeys yet. And you can have both a passkey and a password on the same account, so the old password may still be a way in. Use a long, unique password on each site that needs one. The FTC says to aim for at least 12 characters. Our password generator can make one. The FTC also says text and email codes are “the least secure type” of two-factor authentication, and that an authenticator app or security key gives more protection.

To find out if one of your passwords has leaked, see Am I hacked?

What can go wrong

• You lose a device that holds the only copy of a passkey. Sync your passkeys, or add a second one.
• You create a passkey on a shared or public computer. Google warns that anyone who can unlock that device can access the account.
• The account that syncs your passkeys is weakly protected. Apple requires two-factor authentication for any Apple Account that uses iCloud Keychain.
• A site still accepts an old password or code, which can be phished. Remove that option if the site lets you.
• Scammers still work by phone and text. See AI scams.

What to do now

1. Create a passkey for your Google, Apple, or Microsoft account, starting with the account tied to your email.
2. Make sure your passkeys sync or are backed up, and add one on a second device.
3. Check that your recovery email address and phone number are current.
4. Add passkeys to your bank, shopping, and social accounts as they offer them.
5. Keep strong, unique passwords and two-factor authentication on every site that does not.