Passkey: The Alternative to Passwords

A passkey replaces your password with a cryptographic key tied to your device. No more memorizing, typing, or resetting anything. Here's how it works, how to create one, and what you should know before making the switch.

What is a passkey and how does it work?

A passkey is a pair of cryptographic keys: a private key stored on your device, and a public key registered with the online service. To sign in, your device proves it holds the private key without ever transmitting it.

In practice, each time you log in, the website sends a unique, randomly generated challenge (a string of numbers). Your device responds using the private key - which it never reveals - and the site verifies that response using the public key. Since the challenge is never the same twice, an intercepted response is completely useless: it was only valid for that specific challenge, which has already expired. This is the exact opposite of a password, which is always the same and only needs to be stolen once to be reused indefinitely.

Authentication is triggered by a simple action: Touch ID, Face ID, a fingerprint scan, or your device PIN.

Is a passkey more secure than a password?

Yes, by a wide margin. The fundamental difference is that a password is a shared secret sent to the server - and therefore stealable - while a passkey never transmits its secret. Passkeys rely on elliptic-curve cryptography (P-256 / ECDSA), providing roughly 128 bits of effective security. To achieve an equivalent level with a password, you'd need about twenty completely random characters - something no human naturally generates or remembers.

Beyond raw strength, passkeys eliminate an entire category of risks:

No weak or reused passwords across sites
No password database to steal (the server only stores the public key, which is useless without the private key)
No credential stuffing (testing millions of credential pairs from data breaches)
No forced password changes every 90 days
No absurd password rules (uppercase required, special character, no more than 16 characters)

Why are passkeys resistant to phishing?

A passkey is cryptographically bound to the exact domain it was created for. On a fake site - even one that looks visually identical - it simply won't activate. There's nothing to intercept and nothing to replay.

This is a structural difference from passwords. A fake site can display a login form identical to the real one and capture your credentials. With a passkey, even if the user doesn't notice the deception, authentication silently fails on the technical side, and no usable information is transmitted to the fraudulent site.

This protection works even against real-time AiTM (Adversary-in-the-Middle) attacks, which even traditional 2FA cannot block.

Can my fingerprint be stolen like a password?

No. Your fingerprint (or Face ID) never leaves your device. It doesn't travel over the network and isn't stored on the website's server. It is used solely to locally unlock the cryptographic key, which then handles the actual authentication.

The site never sees your fingerprint, never receives it, and therefore can never have it stolen. This is fundamentally different from a password, which is sent to the server at every login and compromised if the database is breached.

And if Touch ID or Face ID isn't available (injured finger, faulty sensor), your device PIN takes over. Biometrics are a convenience, not a dependency.

How do you create a passkey?

You create a passkey from the security settings of the relevant account by selecting "create a passkey" and confirming with your device unlock method (Face ID, fingerprint, or PIN). The process takes a few seconds and must be repeated for each compatible service.

Depending on your environment:

On a Google account: go to Account Security, then "Passkeys," then "Create a passkey."
On an Apple device: when signing in to a compatible service, iOS or macOS will offer to save a passkey to your iCloud Keychain.
On most compatible websites: a "sign in without a password" or "add a passkey" option appears in your account's security settings.

One important detail at creation time: you're often choosing - without realizing it - where the key will be stored (the system keychain, the browser, or a password manager). That choice determines which devices will have access to it later. Nothing prevents you from creating multiple passkeys for the same account - for example, one per device. Some services, including Octopussian, let you sign in directly with a passkey.

What happens if I lose my phone or computer?

The answer depends on where your passkeys are stored. If they're synced via iCloud Keychain (Apple) or Google Password Manager, they're automatically available on your other devices within the same ecosystem. Switching to a new iPhone or PC with the same account is seamless.

However, if the passkey was only created locally on a single device, losing that device means losing access. This is why most services keep an alternative sign-in method available during the transition period. A password manager that syncs passkeys across devices and browsers significantly reduces this risk.

Where are my passkeys stored?

Passkeys are stored by the provider you choose - or that is selected by default - at the time of creation. The main providers are iCloud Keychain (Apple), Google Password Manager (Chrome), Windows Hello (Windows), and third-party password managers.

Each provider has its own sync scope:

iCloud Keychain syncs across all Apple devices, but not beyond
Google Password Manager syncs across all Chrome browsers regardless of operating system, but not in Safari
On Windows, Windows Hello manages passkeys at the system level, with syncing via your Microsoft account depending on the Windows version
A third-party password manager can work across all devices and browsers

A common pitfall: when creating a passkey, multiple providers may offer themselves simultaneously (the password manager extension, the browser, and the operating system). Touch ID, for example, gives the impression that "the Mac is handling this," when in reality either Chrome or macOS is storing the key behind that gesture. If you don't pay attention to that initial choice, you may not find your passkey on another device later.

The practical consequence: a passkey created in Chrome won't be offered to you when you open Safari on the same Mac, because each provider manages its own list, not shared with others. At creation time, nothing clearly indicates which provider is taking over, and the interface doesn't make it easy to find out afterward either.

How do you view, rename, or delete a passkey?

There is no single place yet to view all your passkeys: they are spread across different interfaces depending on the provider chosen at creation. You manage them in two places - on the device side and on the service side.

To find or delete a passkey depending on where it's stored:

In Chrome: the browser's password settings
On macOS: System Settings, under Passwords
In a third-party manager: in the vault, under the section dedicated to passkeys

On the service side, reputable sites display the list of passkeys registered to your account, with the ability to rename them (to identify the corresponding device) and revoke them. Since it's easy to accidentally create multiple passkeys for the same account across different providers, the simplest approach is to pick one provider and stick with it.

Will passkeys replace passwords?

Not immediately. The major players (Google, Apple, Microsoft) are pushing toward a passwordless future, but as long as not all services support passkeys, passwords remain necessary - and not just out of habit.

There's a concrete reason for this: a passkey alone can lock you out. If a site only allows passkey sign-in and your passkey isn't synced, switching devices could cut off your access entirely. A backup method is therefore still essential today: a strong password - such as a passphrase - a magic link sent by email, or recovery codes. Synced passkeys (iCloud Keychain, Google, third-party manager) greatly reduce this risk by following you from device to device, but that safety net still matters during the transition period.

Adoption is nonetheless moving quickly, and in time passwords should become the exception rather than the rule. In the meantime, a password manager capable of handling both traditional passwords and passkeys offers the best transition experience.

Key takeaways

A passkey is a cryptographic key tied to your device - more secure and simpler than a password
It is structurally resistant to phishing: it only works on the exact domain it was created for
Your fingerprint never leaves your device and cannot be stolen through a website
Choose a single provider to store your passkeys and avoid confusion across devices
Keep a backup method (password, email magic link, recovery codes): a passkey that isn't synced can lock you out
A password manager that supports passkeys simplifies multi-device management

Strong authentication goes hand in hand with a trustworthy hosting environment. Discover our approach to security and data sovereignty.