Passkeys explained: logging in without a password
How Face ID and fingerprints replace typed secrets, why passkeys stop phishing, what sync and recovery really mean, and when to switch.
For most of the web's life, logging in meant a password — a secret you typed, hoped nobody guessed, and reused more often than you admit. Passkeys are the industry's attempt to retire that habit. Instead of a string you remember, you unlock with the same Face ID, fingerprint, or device PIN you already use to open your phone. Behind the scenes, cryptography does the work passwords never did well.
Apple, Google, and Microsoft have been pushing passkeys hard since 2022. Banks and big sites are adding them. The pitch is simple: harder to phish, nothing to leak in a breach dump. The catch is understanding what you actually own when your "password" lives on a device.
What is a passkey, in plain terms?
A passkey is a pair of cryptographic keys made for one site. Your device keeps the private key. The site only ever stores the public key. When you sign in, the site sends a challenge; your device signs it with the private key after you unlock locally. The site checks the signature. Nobody typed a reusable secret, so a fake login page cannot harvest something worth replaying on the real site.
That is the whole phishing advantage. Classic password theft works because the secret is the same wherever you type it. A passkey proof only works for the real domain the key was registered to.
Why are companies pushing this now?
Password breaches never stopped. SIM-swap attacks keep beating SMS codes. Passkeys sit on standards called WebAuthn and FIDO2 that browsers already support. When Apple, Google, and Microsoft sync passkeys through iCloud Keychain, Google Password Manager, and Windows Hello, the cold-start problem shrinks: your keys can follow you to a new phone if you stay inside that ecosystem.
Syncing is also where people get nervous. A passkey synced to the cloud is convenient and introduces a new dependency — your account recovery story becomes as important as the key itself.
What goes wrong in real life?
Cross-device friction. A passkey created on an iPhone may not be sitting on your Windows laptop unless you planned for that. Some sites still keep passwords as a fallback, which can re-open the old attack path. Shared family computers and workplace machines get awkward. And if you lose every device and your cloud recovery, you are back to account-recovery hell — emails, identity checks, waiting on support.
Passkeys reduce phishing. They do not erase account takeover. Someone who controls your Apple or Google account recovery can still cause damage. Treat the cloud account that syncs passkeys like crown jewels: strong lock, real recovery contacts, no recycled codes.
Should you switch?
Yes for the sites that offer it — especially email, banking, and anything tied to money — and keep a password manager as backup while the world finishes migrating. Turn on passkeys where you can, leave a strong unique password only where you must, and write down how recovery works before you need it at midnight.
Passwords trained everyone to memorize secrets. Passkeys train everyone to trust devices and account recovery. That is a better trade for most people, as long as you know which door you are locking and which spare key still exists.