You cannot choose a passkey or make one "stronger" by adding characters. Your device generates it for you. What you can control is how well it is protected and how to recover it if you lose a device. Here is how to use passkeys on an iPhone, Android phone, Windows PC or Mac.
Key Takeaways
- You don't choose a passkey: your device generates a unique cryptographic key pair for each account.
- Nothing secret is stored on the website: the site keeps only a public key, which is useless to a thief.
- Phishing-resistant: a passkey only works on the real website it was made for.
- Your real job: a strong screen lock, a well-protected Apple, Google or password-manager account, and a backup way in.
What a Passkey Actually Is
Passkeys follow FIDO2 and WebAuthn standards. When you create a passkey, your device makes two matching keys. The private key stays with you, stored on your device or in your password manager. The public key goes to the website.
When you sign in, the website sends a random challenge. Your device signs it with the private key, but only after you unlock it with your face, fingerprint, PIN or device passcode. The website checks the signature against the public key it already has. If the two match, you're in. Your private key and biometric data never go to the website.
Why You Can't (and Don't Need to) Make It "Stronger"
A passkey avoids three familiar password problems:
- It can't be guessed. The key is long random cryptographic data created by software, not a word or pattern.
- It's unique for every account. A breach at one company exposes only public keys, which can't be used to log in anywhere.
- It can't be typed into a fake site. Each passkey is tied to the exact web address that created it, so a lookalike phishing page simply can't use it.
What matters is who can unlock your device and access the account storing your passkeys.
How to Set Up a Passkey on Your Devices
Menus vary, but look under a site's Security or Sign-in settings for "Create a passkey." Your device then asks you to confirm with your face, fingerprint or screen lock.
iPhone
iCloud Keychain can sync passkeys to your Apple devices with end-to-end encryption. First make sure it's on: open Settings, tap your name, tap iCloud, then turn on Passwords (called Passwords and Keychain in older iOS versions). After that, when a website or app offers a passkey, tap Continue and confirm with Face ID, Touch ID or your passcode.
Android
On Android, passkeys are usually saved to Google Password Manager and synced through your Google Account. You need a screen lock set up. When an app or a site in Chrome offers a passkey, tap Create, then confirm with your fingerprint, face or screen lock. You may also save them in a compatible password manager.
Windows
Windows uses Windows Hello (face, fingerprint or PIN) to protect passkeys. On Windows 11, you can manage saved passkeys under Settings > Accounts > Passkeys. A locally saved passkey may live only on that PC; create another on a second device. You can also sign in on a PC by scanning a QR code with your phone, which uses the passkey already stored on the phone.
Mac
On a Mac, set up iCloud Keychain first (in System Settings, click your name, then iCloud). Safari, and other browsers that support it, will then offer to save a passkey when a site supports one, and you confirm with Touch ID or your Mac password. Passkeys made on your iPhone show up on your Mac automatically.
Backup and Recovery: Don't Get Locked Out
The biggest risk with passkeys isn't hackers. It's losing access yourself. A few habits keep you safe:
- Turn on syncing through iCloud Keychain, Google Password Manager or a password manager you trust, so a lost phone doesn't take your passkeys with it.
- Lock down the sync account. Your Apple Account, Google Account or password manager now guards every passkey, so give it two-factor authentication and up-to-date recovery details.
- Use a strong screen lock. Google warns that anyone who can unlock your device can use its passkeys, so skip simple codes like 1234 and don't share your phone's PIN.
- Register more than one passkey for important accounts, for example one on your phone and one on your laptop or a hardware security key.
- Keep a backup sign-in method, such as recovery codes stored somewhere safe, until you're comfortable relying on passkeys alone.
iCloud Keychain passkeys don't automatically appear in Google Password Manager. Before switching phones, check that you can still sign in.
Frequently Asked Questions
Does the website get my fingerprint or face scan?
No. Your biometric only unlocks the passkey on your own device. The website receives a signed answer to its challenge, never your fingerprint, face data or private key.
What happens if I lose my phone?
If your passkeys were synced, sign in to your Apple Account, Google Account or password manager on a new device and they should come back. If they weren't synced, use another registered passkey, a backup method or the site's account recovery process.
Should I delete my password after adding a passkey?
Not right away. Many sites keep your password as a backup, and some don't let you remove it. Use the passkey day to day, keep your password strong and unique, and remove it only if the site allows it and you have reliable recovery options.
The Bottom Line
Your device generates the passkey. Protect it with a good screen lock, secure its sync account and keep a backup. Start with your email, banking or phone-carrier account if it offers passkeys.
Comments
Post a Comment