What You Need to Know About Passkeys
Has your phone prompted you to sign in to a website with a passkey? Passkeys are building momentum as a better way to secure accounts and data. They’re a new, convenient security feature, but you might have a few questions. Here are the answers to some of your most pressing questions about passkeys.
Q: What is a passkey and how does it work?
A: A passkey is a relatively new type of digital login credential that is designed to replace traditional passwords. Instead of typing text, you log in using the exact same method you use to unlock your phone or computer, such as facial recognition, a fingerprint scan, or a PIN. Passkeys rely on a highly secure technique called public-key cryptography. When you register an account, your device generates a unique pair of mathematical keys. The public key is shared with the website, while the private key is stored securely on your device. During login, the website challenges your device, which uses the private key to verify your identity.
Q: Why are they considered safer than passwords?
A: Passkeys eliminate the most common ways accounts get hacked. They can’t be guessed, stolen in a data breach, or phished. Because a passkey is digitally bound to a specific domain, you can never be tricked into giving it away to a fake or cloned website. Companies also only store your public key, which is useless to a hacker if a corporate server is compromised in a hack. There is no physical text for a criminal to guess, brute-force, for exploit via credential stuffing.
Q: How do I use a passkey?
A: When you create an account or update your login method, you’ll be given the option to save a passkey to your phone, tablet, or computer. After that, you simply authenticate with biometrics or a PIN when logging in.
Q: Can passkeys work across devices?
A: Yes—in the Apple, Google, and Microsoft ecosystems, passkeys sync securely across your devices when you’re signed in with your account.
Q: What if I lose my device?
A: This is a common concern, but no, you shouldn’t be locked out of your accounts. Most consumer passkeys automatically sync across your devices via encrypted cloud services. So if you lose your phone, your passkeys will be restored when you set up your replacement device. (It’s still a good idea to set up backup options when available.)
Q: Should I start using passkeys?
A: Yes, many experts say. If a site or app offers passkey support, enabling it is a smart move toward simpler, safer logins.
