Passkeys, Explained: Nothing to Type, Nothing to Phish
A passkey replaces your password with a key pair that stays on your device and works for one site only. Set one up in your account's security settings.
A password can be phished because it can be typed. Type it into the wrong page, and someone else can use it. A passkey removes that step. There is nothing to type, nothing to copy, and nothing to hand over.
A passkey replaces your password. This briefing covers what it is, how sign-in works, why a lookalike site gets nothing from it, and how to set one up on an account you already use.
What a passkey is
A passkey is a credential for passwordless sign-in. It is built on FIDO2 standards and standard public-key cryptography, and it replaces a password with a pair of cryptographic keys instead of a secret you have to remember and type.
When you create a passkey, your device generates two keys. The public key is registered with the website or app, and that is the key the site keeps. The private key is stored securely on your device. The site does not hold your private key.
That split matters. The site holds only the public half, and you do not need to memorize either key.
How sign-in works
The site or app sends a challenge to your device. You unlock the device, and the device uses the private key to sign that challenge. The site then checks the signature against the public key it holds and, if it matches, grants access.
Unlocking means using the same method you already use to unlock your device — face, fingerprint, PIN, or pattern. That unlock approves the sign-in and unlocks the private key for that use.
Your biometric information stays on your device during this process. It is not sent to a remote server, and it is not shared with the provider.
Why it resists phishing
A passkey is linked to the specific site or app it was created for. It can only be used there. If you land on a lookalike or fraudulent site, your device will not present the passkey for the real site, because that passkey does not belong to the lookalike.
Passkeys are designed with no shared secrets. There is nothing to type into a fake form, nothing to copy into a message, and nothing to read out to someone who asks for it. The passkey simply does not work outside the place it was made for.
That is a different problem from an approval prompt you are pushed to accept. Our briefing on MFA fatigue attacks covers that separate prompt trick — a signpost only, with no new claim made here about that topic.
Synced passkeys and device-bound passkeys
Passkeys come in two forms. A synced passkey is stored through a passkey provider or credential manager and made available across your devices, with sync protected by end-to-end encryption. Providers named in the source guidance include Google Password Manager, iCloud Keychain, and Microsoft Password Manager.
A device-bound passkey stays only on the device where it was created and is never synced. A passkey held on a hardware security key is the common example of this form.
For background on how managers store and fill credentials, see our briefing on password managers — a signpost only, with no new claim here about how any manager handles passkeys.
Google, Microsoft, and Apple all support creating and using passkeys. The source guidance points to a synced passkey as the practical starting point, because it is available on your other devices instead of living on just one. A security key gives you the device-bound option.
How to set one up
Setup follows one generic pattern on a supported site or account. Open the account's security or sign-in settings, choose Create a passkey, and confirm by unlocking your device with face, fingerprint, or PIN.
Only create passkeys on devices you personally own or control. Make sure the device has its screen lock turned on before you start.
Start with one important account you use daily. Create the passkey, then sign in once with it so you know the flow before you rely on it. If you are working through an account you do not fully trust, our guide to account recovery is a useful next step.
Make it part of your routine
Do it today. Pick one daily account, open its security settings, and create a passkey. It takes one unlock to confirm, and after that you have a sign-in method for that account that does not ask you to type a password at all.
Then make it a habit. When another account offers Create a passkey in its security settings, set one up there too, on a personal device you control, with its screen lock on. One account at a time is enough.
Sources: FIDO Alliance — Passkeys ↗ · Microsoft Support — What are passkeys and why they matter ↗ · Google Account Help — Sign in with a passkey instead of a password ↗ · Apple Developer — Passkeys Overview ↗