Passkey: The Password Alternative

A passkey replaces your password with a cryptographic key tied to your device. No more memorizing, typing, or resetting anything. Here's how it works, how to create one, and what you should know before making the switch.

What is a passkey and how does it work?

A passkey is a pair of cryptographic keys: a private key stored on your device, and a public key registered with the online service. To sign in, your device proves it holds the private key without ever transmitting it.

In practice, each time you log in, the site sends a unique, randomly generated challenge (a string of numbers). Your device responds using the private key-which it never reveals-and the site verifies the response using the public key. Since the challenge is never the same twice, an intercepted response is useless: it was only valid for that one challenge, which is now expired. This is the complete opposite of a password, which is always the same and only needs to be stolen once to be reused indefinitely.

Authentication is triggered by a simple action: Touch ID, Face ID, a fingerprint scan, or your device PIN.

Is a passkey more secure than a password?

Yes, by a wide margin. The fundamental difference is that a password is a shared secret, sent to the server and therefore stealable, whereas a passkey never transmits its secret. Passkeys rely on elliptic curve cryptography (P-256 / ECDSA), providing roughly 128 bits of effective security. To achieve an equivalent level with a password, you'd need around twenty completely random characters-something no human naturally generates or remembers.

Beyond raw strength, a passkey eliminates an entire class of risks:

No weak or reused passwords across sites
No password database to steal (the server only stores the public key, which is useless without the private key)
No credential stuffing (testing millions of credential pairs from data breaches)
No forced password resets every 90 days
No arbitrary password rules (uppercase required, special character, no more than 16 characters)

Why are passkeys resistant to phishing?

A passkey is cryptographically bound to the exact domain it was created for. On a fake site-even one that looks visually identical-it simply won't activate. There's nothing to intercept and nothing to replay.

This is a structural difference from passwords. A fake site can display a login form that looks identical to the real one and capture your credentials. With a passkey, even if the user doesn't notice the deception, authentication silently fails on the technical side and no usable information is transmitted to the fraudulent site.

This protection holds even against real-time AiTM (Adversary-in-the-Middle) attacks, which even standard 2FA cannot block.

Can my fingerprint be stolen like a password?

No. Your fingerprint (or Face ID) never leaves your device. It doesn't travel over the network and isn't stored on the website's server. It is only used to locally unlock the cryptographic key, which then handles the actual authentication.

The site never sees your fingerprint, never receives it, and therefore can never have it stolen. This is fundamentally different from a password, which is sent to the server on every login and is compromised if the database is breached.

And if Touch ID or Face ID is unavailable (injured finger, faulty sensor), your device PIN takes over. Biometrics are a convenience, not a dependency.

How do you create a passkey?

You create a passkey from the security settings of the relevant account by selecting "create a passkey" and confirming with your device unlock method (Face ID, fingerprint, or PIN). The process takes a few seconds and must be repeated for each compatible service.

Depending on your environment:

On a Google account: go to the Security section of your account, then "Passkeys," then "Create a passkey."
On an Apple device: when signing into a compatible service, iOS or macOS will offer to save a passkey to your iCloud Keychain.
On most compatible sites: a "sign in without a password" or "add a passkey" option appears in your account's security settings.

One important decision happens at creation: you're often choosing-without realizing it-where the key will be stored (the system keychain, the browser, or a password manager). This choice determines which devices you'll be able to use it on later. Nothing prevents you from creating multiple passkeys for the same account-for example, one per device. Some services, including Octopussian, let you sign in directly with a passkey.

What happens if I lose my phone or computer?

The answer depends on where your passkeys are stored. If they're synced via iCloud Keychain (Apple) or Google Password Manager, they're automatically available on your other devices within the same ecosystem. Switching iPhones or PCs using the same account is seamless.

However, if a passkey was only created locally on a single device, losing that device means losing access. This is why most services keep an alternative sign-in method available during the transition period. A password manager that syncs passkeys across devices and browsers significantly reduces this risk.

Where are my passkeys stored?

Passkeys are stored by the provider you choose-or that is chosen for you-at the time of creation. The main options are iCloud Keychain (Apple), Google Password Manager (Chrome), Windows Hello (Windows), and third-party password managers.

Each provider has its own sync scope:

iCloud Keychain syncs across all Apple devices, but not beyond
Google Password Manager syncs across all Chrome browsers regardless of operating system, but not in Safari
On Windows, Windows Hello manages passkeys at the system level, with sync via your Microsoft account depending on the Windows version
A third-party password manager can work across all devices and browsers

The common pitfall: when creating a passkey, multiple providers may offer themselves at the same time (the password manager extension, the browser, and the operating system). Touch ID, for example, gives the impression that "the Mac is handling this," when behind that gesture it's actually either Chrome or macOS storing the key. If you don't pay attention to that initial choice, you may not find your passkey on another device.

Practical consequence: a passkey created in Chrome won't be offered if you open Safari on the same Mac, because each provider maintains its own separate list. At creation, it's rarely clear which provider is taking over, and the interface doesn't make it easy to figure out later which one actually holds the key.

How do you view, rename, or delete a passkey?

There is no single place yet to see all your passkeys: they're spread across different interfaces depending on the provider chosen at creation. You manage them in two places-on the device side and on the service side.

To find or delete a passkey depending on where it's stored:

In Chrome: the browser's password settings
On macOS: System Settings, Passwords section
In a third-party manager: in the vault, under the dedicated passkeys section

On the service side, reputable sites display a list of passkeys registered to your account, with the ability to rename them (to identify the corresponding device) and revoke them. Since it's easy to accidentally create multiple passkeys for the same account across different providers, the simplest approach is to pick one provider and stick with it.

Will passkeys replace passwords?

Not immediately. The major players (Google, Apple, Microsoft) are pushing toward a passwordless future, but as long as not every service supports passkeys, passwords remain necessary-and not just out of habit.

There's a concrete reason for this: a passkey alone can lock you out. If a site only allows passkey sign-in and your passkey isn't synced, switching devices could leave you without access. A backup method remains essential today: a password, a one-time sign-in link sent by email, or recovery codes. Synced passkeys (iCloud Keychain, Google, third-party manager) greatly reduce this risk by following the user from device to device, but that safety net still makes sense during the transition period.

Adoption is moving quickly, though, and over time passwords should become the exception rather than the rule. In the meantime, a password manager capable of handling both traditional passwords and passkeys offers the best transition experience.

Key takeaways

A passkey is a cryptographic key tied to your device-more robust and simpler than a password
It is structurally resistant to phishing: it only works on the exact domain it was created for
Your fingerprint never leaves your device and cannot be stolen through a website
Choose a single provider to store your passkeys and avoid cross-device confusion
Keep a backup method (password, email link, recovery codes): a passkey that isn't synced can lock you out
A password manager that supports passkeys simplifies multi-device management

Strong authentication goes hand in hand with trusted hosting. Discover our approach to security and data sovereignty.