A passkey is a passwordless sign-in credential: instead of typing a password, you unlock your phone or computer with your fingerprint, face, PIN or pattern, and the device proves to the website that you hold the right key. Passkeys are built on FIDO2 standards and are designed to resist phishing. To set one up for a Google Account, go to myaccount.google.com/signinoptions/passkeys and choose Create a passkey.
Who this is for
This guide is for people who use Google, Apple or other accounts with passkey support and want to know what a passkey is, whether it is safe, and how to set one up without locking themselves out. It covers personal accounts. For rolling passkeys out to a Microsoft Entra organisation, see Deploy passkeys in Entra ID: Authenticator, Windows Hello and FIDO2 keys.
How passkeys work
Each passkey is a cryptographic key pair. The FIDO Alliance describes the process like this:
- When you create a passkey for a site, your device generates a pair of keys. The site stores the public key. The private key stays on your device or security key.
- When you sign in, the site sends a challenge. Your device signs it with the private key after you unlock the device.
- The site checks the signature with the public key it stored.
Several properties follow from this:
- No shared secret on the server. A breach of the site's database does not expose anything that could be reused to sign in, according to the FIDO Alliance.
- Phishing resistance. There is no secret for you to type, so a fake site has nothing to capture. Each passkey is also tied to the site or app where it was created, so it will not be offered to a lookalike domain.
- Biometrics stay local. The FIDO Alliance states that biometric information and processing stay on the device and are never sent to a remote server. The website only receives confirmation that the check passed.
Apple describes the same approach for its devices: passkeys are built on the WebAuthn standard and use public key cryptography, with a unique key pair created for each account. On devices with Touch ID or Face ID, those features authorise use of the passkey.
Passkeys compared with passwords and codes
| Method | What an attacker needs | Phishing exposure |
|---|---|---|
| Password only | The password | High: it can be typed into a fake site |
| Password plus text code | Password and a code | Code can be relayed on a fake site, and phone-number attacks are possible |
| Passkey | Your unlocked device or security key | Designed to resist: not offered to a lookalike site |
Google's help page says that passkeys cannot be shared, copied, written down or accidentally given to someone else.
Requirements and prerequisites
Google's help page lists these requirements for Google Account passkeys:
- Devices: Windows 10 or later, macOS Ventura or later, ChromeOS 109 or later, Android 9 or later, iOS 16 or later, or a FIDO2 hardware security key.
- Browsers: Chrome 109 or later, Safari 16 or later, Edge 109 or later, or Firefox 122 or later.
- Screen lock: turn on your phone's screen lock.
- Bluetooth: turn it on to use a phone passkey on another computer.
- Apple devices: iCloud Keychain is recommended on iPhone, iPad and Mac.
- Workspace accounts: you may not be able to sign in with a passkey alone, depending on the administrator's settings.
Google also says to create passkeys only on devices you personally own and use, and that you may need to wait 7 days before a new passkey is available at sign-in.
Before you start, make sure you can already sign in to the account and that the account has a recovery method. See Turn On Two-Step Verification for Google, Microsoft and Apple Accounts.
Create a passkey for a Google Account
Steps from Google's help page:
- Go to myaccount.google.com/signinoptions/passkeys and sign in if asked.
- Choose Create a passkey, then unlock your device with your fingerprint, face or screen lock.
- To use a hardware security key instead, choose Use another device and follow the prompts. You will insert the key and enter its PIN or touch its fingerprint sensor.
On the account page, you can see which passkeys are registered. Remove any for a device you no longer use.
Note the timing: Google says you may need to wait 7 days before a new passkey is available at sign-in. Do not remove your other sign-in methods in the meantime.
Passkeys on Apple devices
Apple's platform security documentation says passkeys sync across your Apple devices through iCloud Keychain, which is end-to-end encrypted. Other points from that page:
- Any Apple Account using iCloud Keychain requires two-factor authentication. If you register a passkey without it, you are prompted to set it up.
- A new device joins your iCloud Keychain syncing circle by pairing with an existing device or through iCloud Keychain recovery.
- Passkeys can be recovered through iCloud Keychain escrow even if you lose all your devices. Recovery requires your Apple Account credentials, an SMS response and your device passcode. After 10 failed attempts, the escrow record is destroyed.
- Passkeys can work between Apple and non-Apple devices in physical proximity.
Apple's page does not give step-by-step instructions for creating a passkey in every app. In general, when a site or app offers to save a passkey, you confirm with Face ID, Touch ID or your passcode. Follow the prompt the app shows.
Where passkeys are stored
A passkey is tied to the device or service that holds it. Google's page notes that passkeys are tied to the device where you create them, whether a phone, computer or hardware security key. On Apple devices they can sync via iCloud Keychain, and third-party credential managers may hold them too. When choosing, consider:
- Synced passkeys are convenient and survive the loss of one device, but depend on the security of the sync account.
- Device-bound or security-key passkeys do not move between devices, so you need a second key or another sign-in method as a backup.
Using a passkey day to day
- Go to the site's sign-in page.
- Choose the passkey option, or let the browser offer your saved passkey.
- Unlock the device when asked.
- To sign in on someone else's computer, choose to use a passkey from your phone: you may need Bluetooth on, and the phone confirms the sign-in. On a shared computer, sign out when you finish.
Troubleshooting
| Problem | What to check |
|---|---|
| The option to create a passkey is missing | Confirm your operating system and browser meet the versions above, and that screen lock is on |
| Phone passkey does not work on a computer | Turn on Bluetooth on both devices |
| Passkey not offered right after creating it | Google says you may need to wait 7 days before a new passkey is available at sign-in |
| Workspace account asks for more than a passkey | The administrator's settings may require another step |
| Lost the only device holding the passkey | Use your other registered sign-in method or the provider's recovery page |
Safe habits
- Keep a second sign-in method until you are confident in the passkey.
- Create passkeys only on devices you own.
- Remove passkeys for devices you sell or give away.
- Keep the device passcode private, since it unlocks the passkey.
- Do not approve a sign-in prompt you did not start.
Summary
- A passkey replaces a password with a key pair and a device unlock.
- It is designed to resist phishing and does not send your biometrics to the site.
- Google passkeys need a supported device and browser and are created at myaccount.google.com/signinoptions/passkeys.
- Apple syncs passkeys through iCloud Keychain, which requires two-factor authentication.
- Keep a recovery method registered.
References
- FIDO Alliance, Passkeys: https://fidoalliance.org/passkeys/
- Google Account Help, Sign in with a passkey instead of a password: https://support.google.com/accounts/answer/13548313
- Apple Platform Security, Passkeys: https://support.apple.com/en-us/102195
- Google Account Help, Turn on 2-Step Verification: https://support.google.com/accounts/answer/185839
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.