On this page
Definition
A passkey is a passwordless authentication credential based on public-key cryptography, where a private key stays securely on the user's device and a matching public key is registered with the service, unlocked locally via biometrics or a device PIN.
Simple explanation
Instead of typing a secret word a website checks against its database, a passkey uses two mathematically linked keys: one stays locked on your phone or laptop, the other sits with the website. Logging in proves you hold the private key, without ever sending it anywhere.
Unlocking that private key happens locally, with your fingerprint, face scan or device PIN — the same way you might unlock your phone. The website never sees your biometric data at all; it only receives proof that the right key was used.
Why it matters
Passwords are the root cause of most account takeovers: they get reused, phished or leaked in breaches. Passkeys remove the shared secret entirely, so there is nothing to steal from a phishing page or leaked database that would let an attacker log in elsewhere.
For everyday users, passkeys also simplify life — no password to remember, type or reset, and no separate one-time code to fetch from a text message.
How it works
- 1RegistrationYour device generates a public-private key pair and sends only the public key to the service.
- 2Local storageThe private key stays on your device or in its secure enclave, never leaving it.
- 3Login requestThe service sends a challenge that only the matching private key can answer correctly.
- 4Local unlockYou approve with biometrics or a PIN, which unlocks the private key on-device.
- 5VerificationThe service checks the signed response against the stored public key and logs you in.
Real examples
Products named for illustration only. Inclusion is not an endorsement.
- Apple iCloud KeychainSyncs passkeys across Apple devices, unlocked with Face ID or Touch ID.
- Google Password ManagerStores and syncs passkeys across Android and Chrome.
- GitHubSupports passkeys as a full password replacement for account login.
- 1PasswordStores and autofills passkeys across platforms independent of any one device maker.
Advantages
- Cannot be phished, since there is no shared secret to trick you into typing.
- Immune to password-reuse breaches — each passkey is unique per service.
- Removes the need to remember or manage passwords for supported sites.
- Backed by biometric or PIN unlock that never leaves the device.
Limitations
- Not yet supported by every website or app, so passwords still linger alongside them.
- Switching ecosystems (e.g. iPhone to Android) can complicate syncing depending on the provider.
- Losing every device tied to a passkey without a backup method can lock you out.
- Shared or public computers are less convenient, since the private key doesn't travel with you by default.
Common misunderstandings
- ClaimPasskeys send your fingerprint or face data to the website.RealityBiometrics only unlock the private key locally; the website never receives biometric data at all.
- ClaimPasskeys are just a fancy password manager feature.RealityThey are a different cryptographic model — there is no secret string being stored or transmitted, unlike a password.
Frequently asked questions
What happens if I lose my phone with my passkeys on it?
If your passkeys are synced (e.g. via iCloud Keychain or Google Password Manager), you can recover them on a new device signed into the same account.
Are passkeys more secure than a password plus MFA?
Generally yes — passkeys remove phishing risk entirely, whereas even MFA codes can sometimes be intercepted or approved under pressure.
Can I still use a password if a site offers passkeys?
Usually yes, unless the site has fully removed password login, so you can adopt passkeys gradually.
Do passkeys work across different browsers and devices?
Increasingly yes, through cross-device sign-in standards, though experience still varies by platform and provider.
Is a passkey the same as a security key like a YubiKey?
They're related — both use similar cryptography, but a passkey is typically software-based on your device, while a security key is a separate physical device.
The Tool Money Lab perspective
We expect passkeys to become the default login method over the next few years, but adoption is uneven — plenty of major services still treat them as optional rather than primary.
Where we recommend password managers, we specifically check passkey support, since storing and syncing passkeys is quickly becoming as important as storing passwords.
Conclusion
A passkey replaces the password with a cryptographic key pair, unlocked locally by biometrics or a PIN, removing the phishable shared secret at the heart of most account takeovers.
Support is growing fast but not universal, so most people will use passkeys and passwords side by side for the next few years.