Passkeys are designed to solve a familiar security problem: people must remember too many passwords, so they reuse weak ones or hand them to convincing phishing sites. A passkey lets a device prove that its owner controls an account without sending a reusable secret to the website.
The login can feel simple—scan a fingerprint, look at the camera or enter a device PIN—but the cryptography underneath is very different from password autofill.
What is a passkey?
A passkey is a pair of cryptographic keys created for one account on one service. The public key is stored by the service. The private key remains with the user's device or trusted credential provider.
When the user signs in, the service sends a challenge. The device uses the private key to sign it after local approval. The service verifies the response using the public key.
The private key is not revealed during the exchange, and a public key stolen from the service's database cannot be used to sign in.
Why passkeys resist phishing
A password can be typed into any form, including a fake page. A passkey is bound to the website or app for which it was created. The browser and operating system check that identity before allowing authentication.
That means a lookalike domain cannot normally request a valid passkey for the real service. The user also has no shared secret to read aloud, paste into a message or accidentally disclose.
Passkeys do not make every account attack impossible. A compromised device, malicious recovery process or tricked support agent can still create risk. They remove one of the most common routes: stealing the password itself.
Is your fingerprint sent to the website?
No. Face, fingerprint and device-PIN checks happen locally. They unlock use of the private credential; they are not transmitted as the account password.
The service normally learns that the device produced a valid cryptographic response, not which biometric was used. On a device without biometrics, the screen-lock PIN can perform the local approval.
How passkeys sync between devices
Platform credential managers can synchronise passkeys across devices signed into the same protected account. This allows a passkey created on a phone to appear on a laptop without manually exporting a file.
The sync provider encrypts the credential and controls recovery. Users should therefore protect the platform account with strong recovery information and multifactor security.
Some passkeys are device-bound, especially in managed workplaces or hardware security keys. Those credentials do not automatically travel to another device.
Signing in on a borrowed computer
A user can often choose “use a passkey from another device.” The computer displays a QR code, which the phone scans. Bluetooth proximity and an encrypted exchange help confirm that the devices are near each other.
The phone approves the login without copying the passkey permanently to the borrowed machine. Users should still sign out when finished and avoid a computer they believe is compromised.
What happens if the phone is lost?
A synced passkey may be restored on a replacement device after the owner recovers the platform account. Another previously authorised device can also provide access.
Services frequently retain fallback recovery methods, such as a recovery code, verified email or identity review. Those methods become the weakest link if they are easy to exploit.
Before switching fully to passkeys, users should add more than one trusted device or hardware key and securely store recovery codes.
Can passkeys coexist with passwords?
Yes. Many services introduce passkeys as an optional sign-in method while keeping passwords for older devices and account recovery. During this transition, the account remains vulnerable to attacks against the password if that route is still enabled.
Some services allow users to remove the password entirely. Others use a passkey as a strong second factor. The security benefit depends on which fallback methods remain available.
Passkeys versus authenticator codes
An authenticator app generates short-lived codes, usually after a password has already been entered. Passkeys can replace both the password and the second step in one phishing-resistant exchange.
Codes are still valuable when passkeys are unavailable, but a sophisticated phishing site can relay a code in real time. A correctly implemented passkey verifies the genuine site before responding.
What users should check before creating one
Confirm where the passkey will be saved: a phone's credential manager, a browser profile, a password manager or a physical security key. Check that the device has a secure screen lock and that cloud-account recovery is current.
On shared devices, avoid saving a passkey into another person's profile. In a workplace, follow the organisation's policy because administrators may require device-bound credentials.
The bottom line
Passkeys replace a reusable password with a private cryptographic credential unlocked locally. They are easier to use, difficult to phish and safer after a website database breach. The remaining responsibility is protecting devices, sync accounts and recovery routes.
For more digital coverage, visit the Technology section and read our guide to AI Overviews in search results.
Technical basis: FIDO Alliance passkey guidance and the W3C Web Authentication standard. Exact sync and recovery behaviour depends on the platform and service.
