What a passkey is and why you might create one
A passkey is a digital credential stored on your device — your phone, computer, or tablet — that proves who you are without requiring you to type a password. When you create a passkey for a website or app, you're storing a unique key on that device. The next time you log in, the website or app recognizes your device instead of asking you to remember and enter a password.
Passkeys work through a technology called public-key cryptography. Your device holds a private key (the part that stays secret) and the website holds a public key (the part that's shared). When you try to log in, your device proves it has the matching private key without ever sending the password itself across the internet. This makes passkeys harder to steal than passwords, because there's no password to intercept or guess.
You might create a passkey because a website you use regularly now offers them, or because you want a faster way to log in without typing. Some banks, email providers, and social media platforms have started supporting passkeys. Creating one takes about two minutes per account.
Key Takeaways
- A passkey is a digital credential stored on your device that replaces your password for a specific website or app.
- You create a passkey by going to your account settings, finding the security or login section, and selecting the option to add a passkey.
- Your device will ask you to confirm your identity using your fingerprint, face, or PIN before creating the passkey.
- Once created, a passkey only works on the device where you made it — you'll need to create separate passkeys on your phone, tablet, or computer if you want to use them on multiple devices.
- You can still use your password to log in even after creating a passkey; the two methods work alongside each other.
Finding the passkey option in your account settings
The location of the passkey option varies by website, but it's almost always in your account settings under a security or login section. Log into the account where you want to create a passkey, then look for a menu labeled "Settings," "Account," "Security," or "Privacy." On most websites, this menu appears in the top right corner or in a hamburger menu (three horizontal lines).
Once you're in settings, look for a section called "Security," "Login methods," "Sign-in options," or "Authentication." Some sites group it under "Password and security" or "How you sign in." If you can't find it by scanning the menu, use the search function within settings — most account pages have a search bar where you can type "passkey" and it will take you directly to the right section.
If the website doesn't offer passkeys yet, you won't see this option at all. Not every website supports them. You can check whether a site supports passkeys by visiting passkeys.dev, which maintains a list of major websites and apps that offer them.
Creating the passkey step by step
Once you've found the passkey section, look for a button that says "Add a passkey," "Create a passkey," "Set up passkey," or "Enable passkey." Click or tap that button. The website will then ask you to confirm your identity using the security method already set up on your device.
On an iPhone or iPad, you'll see a prompt asking you to use Face ID or Touch ID. Look at the screen or place your finger on the sensor. On an Android phone, you'll be asked for your fingerprint, face recognition, or your device PIN — whichever method you've set up. On a Windows computer, you might be asked for Windows Hello (face or fingerprint), a PIN, or your Windows password. On a Mac, you'll typically use Touch ID or your Mac password.
After you've confirmed your identity, the website will show you a confirmation message saying the passkey has been created. Some sites will ask you to name the passkey (for example, "My iPhone" or "Work laptop") so you can tell them apart if you create multiple passkeys on different devices. You can usually accept the default name or type something more descriptive.
That's the entire process. The passkey is now stored on your device, and you're done. The next time you visit that website, you'll see an option to sign in with your passkey instead of entering your password.
Understanding device-specific passkeys
A passkey created on your iPhone only works on your iPhone. If you want to log in on your Android phone, your laptop, or a tablet, you'll need to create a separate passkey on each of those devices. This is by design — the passkey is tied to that specific device's security system.
If you have an iPhone and a Mac, Apple's iCloud Keychain can sync passkeys between them automatically, so you only need to create the passkey once and it works on both devices. Android phones and Windows computers don't have this automatic sync yet, so you'll need to create separate passkeys manually on each device.
Some websites let you create multiple passkeys for the same account. This is useful if you want to log in from your phone, your work computer, and your home computer — you'd create three separate passkeys, one on each device. You can manage all of them from your account settings and delete any you no longer use.
What happens when you sign in with a passkey
The next time you visit the website, you'll see a login screen. Instead of a password field, you'll see an option to "Sign in with passkey" or "Use passkey." Tap or click that option. Your device will when ready ask you to confirm your identity using the same method you use to unlock your device — your fingerprint, face, or PIN.
Once you've confirmed, you're logged in. There's no password to type, no code to remember, and no waiting for a text message. The entire process takes about five seconds. If someone else tries to use your device, they can't log into your account because they can't pass the fingerprint or face check.
If you're on a different device that doesn't have a passkey for that account, you can still log in with your password the old way. Passkeys don't replace your password — they exist alongside it. You can use whichever method is available on the device you're using.
Recovering access if you lose your device
If your phone is lost or stolen, the passkey stored on it becomes useless because the thief can't unlock your device without your fingerprint or face. However, you'll need another way to log into your account on a new device. This is why websites that support passkeys usually keep your password active as a backup.
If you've deleted your password and only have a passkey, you may need to use an account recovery process. Most websites let you verify your identity using a recovery email address or a phone number, and they'll send you a link to reset your password or create a new passkey on your replacement device. Check your account settings to see what recovery options are available.
Some websites also offer recovery codes — a list of one-time codes you can save in a safe place and use if you lose access to your device. If your site offers this, it's worth saving the codes somewhere find, like a password manager or a locked drawer.
Passkeys versus passwords: what changes and what stays the same
Creating a passkey doesn't force you to delete your password. Both can exist at the same time, and you can choose which one to use each time you log in. Some people create passkeys on their main devices and keep their password as a backup for logging in on shared computers or borrowed devices.
The main difference is convenience and security. A passkey is faster — no typing — and it's harder to steal because there's no password for a hacker to intercept or guess. A password is more flexible because it works on any device, even one you've never used before, as long as you remember it.
Over time, more websites will likely support passkeys, and they may become the standard way to log in. For now, they're an option you can use alongside passwords. If a website you use regularly offers passkeys, creating one takes just a few minutes and makes logging in faster every time after that.
Frequently Asked Questions
Can I use the same passkey on multiple websites?
No. Each passkey is unique to the specific website where you created it. A passkey you create for your email account won't work for your bank account. This is a security feature — if one website is compromised, the passkey for that site alone is exposed, not your passkeys for other accounts.
What if I create a passkey but then forget how to use it?
You can still log in with your password. Passkeys and passwords work side by side, so you're never locked out. You can also delete the passkey from your account settings and create a new one if something goes wrong, or just stick with your password if you prefer.
Do I need to create a passkey on my work computer too?
Only if you want to log in on that computer using a passkey. If you prefer to use your password on your work computer and a passkey on your personal phone, that's fine. You can create passkeys on some devices and not others for the same account.
What happens if my device is stolen after I create a passkey?
The passkey is locked behind your device's security — the thief would need your fingerprint, face, or PIN to use it. However, you should change your password and contact the website to report the device as lost. Most sites let you delete passkeys from your account settings remotely.
Can I move a passkey from one device to another?
Not directly. You'll need to create a new passkey on the new device. However, if you're upgrading to a new iPhone or Android phone and you back up your device, passkeys usually transfer as part of that backup. Check your device's backup settings to confirm passkeys are included.