What Is a Passkey? A Plain-English Guide to Signing In Without a Password

You sign in to an account and see a new prompt: “Create a passkey.” Before accepting, you want to know what you are saving, who holds it, and whether losing your phone means losing your account.

The useful question is not whether you trust your fingerprint more than a password. It is where the passkey will live, and how you would sign in without that device.

What is a passkey? (the short answer)

A passkey is a digital credential that lets you sign in to a supporting website or app without typing that account’s password. You usually approve the sign-in with a fingerprint, face scan, device passcode, or PIN.

It is not your fingerprint, and it is not a password you need to memorize. It uses a pair of cryptographic keys. Your device or credential manager holds the private key. The service stores the matching public key, which lets it check a sign-in without receiving the private key.

Passkeys use FIDO standards, including WebAuthn for websites. Each credential belongs to an account at a particular service. A passkey for Google is not a universal passkey for Amazon or every other account.

Passkey vs password: what actually changes

With a password, you provide a reusable secret. A well-run service stores a protected representation of that password, rather than readable text. But you can still give the password to a convincing fake login page.

With a passkey, you approve a cryptographic response instead of typing that secret. You do not choose a weak passkey or reuse the same one across unrelated sites.

A passkey can replace the password as your main sign-in method. Creating one does not necessarily delete your existing password. Google explicitly says it leaves existing authentication and recovery factors unchanged, and Amazon still allows password sign-in.

A passkey also differs from an authenticator app’s one-time code. A code can be typed into a phishing page. A correctly implemented passkey sign-in is bound to the legitimate service. When the service requires local user verification, the credential plus your PIN or biometric can provide multiple authentication factors without a separate code. OWASP cautions that this depends on the service requiring and checking that verification.

What the website stores (and what it never sees)

The service stores the public key and information needed to associate it with your account. It does not receive the private key during normal passkey registration or sign-in.

Your fingerprint or face is checked locally. The website receives cryptographic proof, not your fingerprint image or face scan. Passkey Central explains the separation between the local unlock and the proof sent to the service.

Stealing the public key alone does not let someone generate valid sign-ins. That does not make the website breach-proof. An attacker who controls the service, its account records, or an existing signed-in session can cause other damage.

Why a fake login page can’t steal a passkey

Your browser restricts which website can request a particular credential. A lookalike domain does not qualify just because its logo and login form look convincing.

MDN describes how passkey scope and origin checks work. A credential registered for example.com cannot normally be used by an unrelated lookalike such as examp1e.com. The service must also verify the response correctly.

This is phishing resistance, not protection against every scam. A fake page can still ask for a leftover password, a recovery code, payment information, or a software download. A passkey cannot make those requests trustworthy.

How a passkey sign-in works, step by step

When you create a passkey, your chosen provider generates the key pair and registers the public key with the service. Check the save-location prompt: it tells you which provider or device will hold the credential.

So how do passkeys work on your next visit? The standard sign-in flow looks like this:

1. You open the real website or app and choose a passkey sign-in, sometimes through an account suggestion.
2. The service sends a fresh challenge, a one-time piece of data for this sign-in.
3. Your browser and passkey provider find a credential that matches the service. You may need to choose an account.
4. You approve its use, typically with your face, fingerprint, device passcode, or PIN.
5. The provider uses the private key to sign the challenge. The service checks the response with its stored public key and signs you in if the checks pass.

You do not read, copy, or send the private key yourself. The local PIN unlocks use of the credential. It is not your new password for that website.

Some systems let a nearby phone approve a computer sign-in through a QR code. Google’s account help describes this phone-to-computer flow. Chrome’s help says your passkeys remain on the other device, so you do not have to save one on that computer.

Where your passkeys are stored

A passkey can stay on one device or be synchronized through a provider. Those choices have different consequences when you replace or lose hardware.

On your phone or computer

A device-bound passkey stays with its authenticator. A passkey saved locally with Windows Hello is different from one saved in a synced password manager.

Google’s Chrome help says Windows Hello passkeys are not synced or backed up. Losing the computer or reinstalling its operating system can mean losing those credentials. You need another way into each affected account.

Synced passkeys (Google Password Manager, iCloud Keychain)

A synced passkey can become available on other supported devices through the same credential provider. It is not automatically available in every browser or ecosystem.

Google documents synchronization through Google Password Manager and says those passkeys are end-to-end encrypted. Access on a new device requires the Google Account and an additional unlock factor, such as the Google Password Manager PIN or an Android device’s screen lock.

Apple says iCloud Keychain sync is end-to-end encrypted with keys Apple does not know. Its device approval and recovery requirements still matter. Signing in to an Apple Account alone is not a promise of unconditional access to every saved credential.

Microsoft also offers synced storage. Its Edge announcement documents Microsoft Password Manager passkey sync in Edge on Windows for personal Microsoft accounts, protected by a separate manager PIN. Do not confuse that with local Windows Hello storage. Microsoft’s current management guidance distinguishes the two.

In a third-party password manager

Some third-party password managers can create, store, and sync passkeys. FIDO identifies these apps and browser extensions as another category of passkey provider.

Check the provider’s supported devices, recovery process, and passkey features before relying on it. Password support does not automatically mean passkey support on every platform.

On a hardware security key

A compatible FIDO2 hardware security key can hold a device-bound passkey. You plug in or tap the key and approve its use, with a PIN or biometric where required.

The credential stays on that physical key rather than syncing through a cloud account. Passkey Central explains this storage model. A separately registered spare can provide another route into an account if the everyday key disappears.

What happens if you lose your phone

Losing your phone does not always mean losing your passkeys. It also does not guarantee that recovery will be straightforward.

For a synced passkey, another device already connected to the provider may still have access. A replacement device may recover access after you meet the provider’s sign-in, unlock, and recovery requirements. Apple documents specific conditions for recovering iCloud Keychain. Google likewise requires more than just a new phone to unlock synced credentials.

For a device-bound passkey on the lost phone, you cannot assume a cloud copy exists. Use another registered passkey, a security key, or whatever backup sign-in or recovery method that service supports. If none works, you may be locked out.

Prepare before losing anything:

• Check where your passkeys are saved and whether they sync.
• Register another authenticator where the service allows it.
• Keep recovery information current and store any service-provided backup codes securely, away from the phone you might lose.
• Learn the credential provider’s recovery requirements, too.

After a loss, use a trusted remaining device to review account access and revoke the lost device’s registered credentials as appropriate. Follow the provider’s lost-device guidance. Do not assume that deleting one local entry signs out every existing session.

Should you create a passkey? When to say yes, when to wait

For a personal device you control, a passkey is generally worth creating once you understand the storage and backup arrangements. The UK National Cyber Security Centre recommends passkeys over passwords wherever available.

Say yes when you recognize the service, control the device and provider account, and know another way to recover access. Afterward, confirm where the credential was saved.

Wait if the prompt would save a credential on a shared or public computer, or if the storage destination is unclear. Google warns that anyone who can unlock a device holding your Google passkey may access your account, even after you sign out. For a managed work account, follow your organization’s rules.

Are passkeys safe? They remove several common password risks, but OWASP identifies limits around compromised devices, sync accounts, recovery, and signed-in sessions. A stolen, already-unlocked phone can expose active sessions. A thief who also knows its passcode may be able to authorize credential use. The exact protection depends on the device and provider.

Keep your screen lock private, update devices, protect the sync account, and review recovery settings. If a password remains enabled, keep it unique and protect it with the service’s available security options. Adding a passkey does not remove that fallback’s risks.

How to see or remove passkeys you’ve created

Check two places: the service’s account-security settings and the provider that stores the credential. The first controls whether the service accepts it. The second manages your saved copy. Removing it in one place does not automatically remove it from the other.

For Google, use the account’s passkey sign-in options and Google’s official checking and removal guidance. Automatically created Android passkeys have a different removal route involving signing the device out under Manage all devices. Follow the instructions for your passkey type rather than deleting unrelated password-manager data.

If a removed Google passkey still appears as a suggestion, Google’s help advises checking the third-party credential manager and removing the saved entry there, too.

On iPhone, Apple explains how to find and delete saved passkeys in Passwords. On Windows, Microsoft’s management guide covers local passkeys, provider settings, and Microsoft account registrations.

Before removing your last usable credential, confirm another sign-in method works. If the device was stolen, prioritize revoking access through the service, not just tidying your password manager.

FAQ

What is a passkey on Amazon?

It is a credential for your Amazon account that lets you approve sign-in with your device’s face, fingerprint, or PIN instead of an Amazon password. Amazon’s official help says passwords remain available and different Amazon marketplaces may require separate setup.

How do I remove a passkey from Google?

Start with your Google Account’s passkey sign-in options and follow Google’s removal instructions. The route differs for automatically created Android passkeys. Also check your credential manager if the deleted passkey still appears.

What is a passkey on Google, and how do I create one?

It is a passkey registered to your Google Account, not a replacement for every saved password. Use Google’s official creation guidance on a device you own. Google Password Manager separately stores passkeys for other supporting services.

Can I use a passkey on iPhone without Face ID?

Yes. Apple’s iPhone guide documents Touch ID or the device passcode as alternatives. Its iCloud Keychain passkey experience requires iCloud Keychain and two-factor authentication.

What is a Windows passkey?

It is a passkey used through Windows, not necessarily one stored only on that computer. Microsoft’s official guide distinguishes Windows Hello, synced credential managers, phones, and security keys. Check the save location before assuming it is backed up.