Passkey
What it means
A passkey is a way to sign in to an account without entering a traditional password. It uses cryptographic credentials associated with your device or password manager and is usually unlocked using a device PIN, fingerprint, face recognition or another local authentication method.
In ordinary use, a passkey feels wonderfully simple: instead of typing a password, you confirm with a fingerprint or face scan, and you are in. Behind that simple experience is a clever piece of cryptography that makes passkeys both easier and safer than passwords for most people.
The core idea is a pair of keys — one private, one public. When you create a passkey for a website, your device generates a private key it keeps to itself and a public key it shares with that site. When you sign in, the site sends a challenge that only your private key can answer correctly; your device solves it (after you unlock it locally) and proves who you are. The website never sees the private key, and the private key never travels across the internet.
A detail that often surprises people: using your fingerprint or face to unlock a passkey does not usually send your biometric data to the website. The biometric check happens locally on your device, simply to unlock the passkey stored there. The site receives proof that you authenticated, not a scan of your face.
This design gives passkeys a genuine advantage over passwords: they cannot be phished in the usual way, because the cryptography is tied to the specific website, so a fake login page cannot capture something it can reuse elsewhere. They also cannot be stolen in a data breach of the website, because the site only ever held the public key. Compared with two-factor authentication codes, passkeys are both stronger and less effort.
A few things are worth knowing. Passkeys can be synchronised across your devices by your platform (Apple, Google or a password manager), which is convenient and usually safe — but it means your passkeys live within that ecosystem. If you move between ecosystems, recovery takes a little thought. And because passkeys are tied to devices, planning for a lost or replaced device — knowing how your passkeys are backed up or synced — avoids a lockout later.
Passkeys are increasingly supported by major services, and where they are offered they are usually worth adopting. They are not a silver bullet, but for most people they are a clear upgrade on the password-plus-code routine: simpler to use and harder to phish at the same time.
Why it matters
Passwords are both hard to remember and easy to steal, which is why so many accounts are compromised through phished or reused passwords. Passkeys offer a rare combination: stronger security and less effort. By removing the password from the sign-in entirely, they remove the thing that gets phished — which makes everyday account security genuinely easier for ordinary people, not harder. For a plain-English comparison, see Passkeys vs Passwords: What's the Difference?.
A practical example
Consider a phishing email that sends you to a convincing fake banking site. With a password, you might type it in and hand it over. With a passkey, the sign-in is cryptographically bound to the real bank's address, so your device simply will not offer the passkey to the fake site. The phishing attempt fails not because you noticed something was wrong, but because the technology refused to be tricked. The protection is built into the sign-in itself.
Related terms
This term is explored fully in Protect Your Digital Life.