Passkeys Explained: Why Your Passwords Are Being Replaced

Google, Apple, Microsoft, banks and shopping sites are now asking you to "create a passkey". It is the biggest change to how we log in since the password was invented, and it is designed to make phishing almost useless. Here is how it works, in plain language.

In one line: a passkey lets you sign in with your fingerprint, face or phone PIN, and there is no password for anyone to steal, guess or trick you into typing on a fake site.

The problem with passwords

• People reuse them, so one leaked site exposes many accounts.
• Fake login pages trick people into typing them in.
• Websites store them, and databases get hacked.
• Strong passwords are hard to remember, so people write them down or keep them simple.

How a passkey works

Passkeys use public-key cryptography, the same mathematics that secures banking websites. When you create a passkey, your device generates two linked keys:

• A private key that never leaves your device, locked behind your fingerprint, face or PIN.
• A public key that the website stores. It is useless to a hacker on its own.

When you log in, the website sends a random challenge. Your device signs it with the private key after you unlock it with your fingerprint or face. The site checks the signature with the public key. Nothing secret travels over the internet.

Why phishing stops working

A passkey is tied to the real website's address. If a scammer builds a fake page that looks identical, your device simply will not offer the passkey for it. There is nothing to type, so there is nothing to steal.

What if I lose my phone?

Most passkeys sync through your Google, Apple or Microsoft account, protected by end-to-end encryption, so they are available on your new phone after you sign in. You can also keep a backup sign-in method on important accounts. Set this up before you need it.

How to start

1. Begin with your main email account. Look for "passkeys" in its security settings.
2. Add passkeys for banking and shopping apps that support them.
3. Keep your phone's screen lock strong, because it now guards your accounts.

Frequently asked questions

Does the website get my fingerprint?

No. Your fingerprint or face only unlocks the key on your own device. It is never sent to the website.

Can someone use my passkey if they have my phone?

Only if they can also unlock it with your fingerprint, face or screen lock PIN.