Loading
A plain-language guide to passkeys — the password replacement backed by Apple, Google, and Microsoft. Learn what they are, why they are more secure, and how to set them up on every major platform.
Secure Your AccountsA passkey is a replacement for your password. Instead of typing a password that can be guessed, stolen, or phished, you sign in using your fingerprint, face, or device PIN — the same unlock method you already use on your phone or laptop.
Behind the scenes, your device creates a unique cryptographic key pair:
Stays on your device and is never shared with anyone. Your device proves it holds this key without ever sending it. A fake login page gets nothing.
Stored by the website or app. This is useless without the private key on your device — even if an attacker hacks the server, they get nothing useful.
The website asks your device to generate a key pair. You confirm with your fingerprint, face, or PIN.
This is like giving the website a lock. Only your device has the key to open it.
The website sends a challenge. Your device signs it with the private key after biometric confirmation. You are in.
| Attack | Passwords | Passkeys |
|---|---|---|
| Phishing (fake login page) | User enters password, attacker steals it | Passkey only works on the real website — fake pages are ignored |
| Credential stuffing | Attacker tries leaked passwords from other sites | Each passkey is unique per site — cannot be reused |
| Brute force (guessing) | Attacker guesses weak passwords | No password exists to guess |
| Keylogger | Records your password as you type | Nothing useful to record — biometrics are not transmitted |
| SIM swap (bypass SMS MFA) | Attacker steals phone number to intercept codes | Passkey does not use SMS — tied to your physical device |
| Database breach | Attacker steals hashed passwords from the server | Server only stores the public key — useless without your device |
As of March 2026, over 15 billion accounts across major platforms support passkeys. Here are the most common services:
For a complete, up-to-date list of services supporting passkeys, visit passkeys.directory — a community-maintained directory of every service with passkey support.
Windows 11 supports passkeys natively through Windows Hello.
Manage passkeys on Windows:Go to Settings > Accounts > Passkeys to view and manage all passkeys stored on your device.
Apple stores passkeys in iCloud Keychain and syncs them across all your Apple devices.
Android stores passkeys in Google Password Manager and syncs across your Google account.
A hardware key (YubiKey, Google Titan, Feitian) is a physical device that stores your passkey. Best for high-security accounts.
Passkeys do not replace all your passwords overnight. Here is a practical migration approach:
Every time you log into a service and see a "Create a passkey" prompt, take 30 seconds to set it up. Over time, most of your accounts will have passkeys.
Some services now allow you to delete your password entirely after setting up a passkey. Google and Microsoft both support this.
Week 1
IT admins and security team
Week 2-3
Executives and finance team
Month 2
All employees (voluntary)
Month 3-4
All employees (required for sensitive apps)
If your passkeys are stored in iCloud Keychain, Google Password Manager, or a password manager like Bitwarden, they sync across devices. Sign in on another device and your passkeys are still there. Best practice: Always have at least two ways to sign in — a passkey on your phone and a passkey in a password manager or on a security key.
Yes — passkeys are built on the FIDO2 standard (WebAuthn + CTAP). "Passkey" is the user-friendly name that Apple, Google, and Microsoft agreed on. Technically, every passkey is a FIDO credential.
No known practical attack can steal a passkey remotely. The private key never leaves your device and cannot be extracted. The only attack vector is physical theft of your device combined with breaking your biometric or PIN — which is orders of magnitude harder than stealing a password.
Yes. Most services let you keep your password while also adding a passkey. When you sign in, you can choose either method. Over time, you can transition to passkey-only.
CyberITEX can help you deploy passkeys across your organisation, configure phishing-resistant MFA in Microsoft 365, and eliminate password-based attacks. Set up takes less than a day for most small businesses.
One email per month with our best articles. No spam.