More and more websites are asking whether you want to "create a passkey." It sounds technical, but the idea is simple, and for most people it is an improvement.
What a passkey is
A passkey is a way to sign in without typing a password. Instead, your phone or computer confirms it is you, using the same thing you already use to unlock it: your fingerprint, your face, or your device PIN.
Behind the scenes, your device holds a secret key that never leaves it, and the website holds a matching public key. When you sign in, the two are checked against each other. There is no password for anyone to steal or guess.
Why it is safer
- There is nothing to type into a fake website. A passkey only works on the real website it was made for, which stops most phishing.
- If a website is breached, there is no password in its records for attackers to reuse elsewhere.
- You do not have to remember it or make it complicated.
What it is like to use
- When a website offers it, choose to create a passkey, usually in the account or security settings.
- Your device asks for your fingerprint, face or PIN to confirm.
- Next time you sign in, choose the passkey option and confirm the same way.
Where passkeys are kept
Passkeys are usually stored in your device's password system, such as your Apple account, your Google account, or a password manager. That lets them sync to your other devices signed in to the same account. If you lose a phone, your passkeys are still available on your other devices or after you sign in on a new one.
Things to keep in mind
- Keep your phone or computer locked with a PIN, fingerprint or face. The passkey is only as protected as the device.
- Many websites keep your password as a backup. That is normal, so keep that password strong and stored in your password manager.
- If you share a device with others, be thoughtful about which accounts you create passkeys for on it.
Would you like help turning on passkeys for your main accounts? Get tech help.