ArticlesA login can be both easier to complete and harder to trick. Passkeys are designed to replace passwords with a sign-in credential that is unlocked on a device, often with a fingerprint, face scan, PIN, or other screen lock. They are becoming an option on many websites and apps, but the terminology can make them sound mysterious. Understanding what is stored, what moves between devices, and what happens when a device is lost makes it easier to decide whether to use one.
From a secret you type to a pair of keys
A password is a secret a person memorizes and types into a service. A passkey instead uses public-key cryptography. When a passkey is created for an account, the credential is associated with that particular service. In simplified terms, the device or passkey manager holds a private key, while the service keeps a corresponding public key. The private key is not a password that the website asks you to reveal. During sign-in, the service sends a challenge and the passkey system uses the private key to produce a response that the service can check with its public key [1].
That difference changes the information exposed during an ordinary login. A person does not type a reusable password into a page, and the website does not need to store the same secret that the person would enter. The prompt to use a passkey is handled by the device, browser, operating system, or credential manager. The person approves the action locally, usually by unlocking the device. The website receives confirmation of the sign-in rather than the person's fingerprint or face data [1][2].
What happens during sign-in
After choosing a passkey option, a user may see a device prompt, a list of saved accounts, or a request to use a phone or security key. The user verifies locally with the device's supported method. A passkey can also be used across devices: for example, a person at a computer may approve a sign-in from a phone. Depending on the setup, the browser can display a QR code and ask the phone to confirm the request; the user still checks the sign-in on the phone itself [2].
The exact screens vary by service, device, browser, and passkey provider. Some accounts let users continue with a password, while others offer a passkey-first flow. Work or school accounts may have organization-specific rules. A passkey appearing on one phone does not guarantee that every browser or device supports the same flow, so it is useful to keep account recovery details current and know which device or provider holds a credential.
Why passkeys help against phishing
A convincing fake sign-in page can persuade someone to type a password into the wrong place. Passkeys change that interaction: the cryptographic credential is associated with the intended website or app, and the user approves a request through the device's system interface. FIDO describes passkeys as phishing-resistant because the credential response is tied to the proper service rather than being a password that can be copied from one page and replayed at another [1].
That is a meaningful protection, not a promise that an account can never be compromised. A compromised device, an unsafe account recovery process, an exposed email account, or a fraudulent request that the user approves can still create risk. A passkey also does not make a fake link harmless: it is still wise to open important services using a trusted bookmark or the official app, review security alerts, and protect the devices used to approve sign-ins. Think of passkeys as strengthening one important part of account security, not replacing every other safeguard.
Synced and device-bound credentials
A passkey can be stored in a credential manager that synchronizes credentials across a person's devices, or it can be bound to one particular device or hardware security key. A synced passkey can make a new phone or computer more convenient when it uses the same provider. A device-bound credential stays attached to its specific authenticator, which can suit situations where a person wants a separate physical key or a more controlled device setup [1].
Neither arrangement is universally best. Synchronization can help with ordinary device replacement, but the user then depends on the security and availability of the provider account that stores and syncs credentials. A device-bound key can be a useful independent option, but losing it may require another sign-in method or recovery process. The account's risk, the user's devices, accessibility needs, and tolerance for keeping a spare all matter. Check the provider's actual description rather than assuming every passkey is stored or backed up in the same way.
Plan for recovery before you need it
Passkeys remove the chore of remembering a password for each service, but they do not remove the need for account recovery. Before relying on a passkey, check whether the account still has recovery options, such as another trusted device, a backup security key, or the provider's documented recovery route. Google, for example, notes that adding a passkey does not itself remove existing authentication or recovery factors, and its help guidance explains how to review or remove a credential associated with a lost device [2]. Other services may work differently.
A practical way to reduce lockout risk is to keep at least one independent way back into important accounts. That might mean registering a second passkey on a separate device or maintaining a recovery method that is stored securely. Do not keep a spare key beside the device it is meant to back up, and do not put recovery codes in an unprotected note or screenshot. Make sure the email account and phone number used for recovery are themselves current and protected.
Shared devices need special care. If another person can unlock a device that contains a passkey, they may be able to use it to access accounts, depending on the service and settings. Create passkeys only on devices you control, sign out on devices you no longer use, and remove the credential from the account if a device is lost or transferred. Review the account's device list as well as the passkey list; removing one saved credential may not sign out every active session [2].
How to start using passkeys thoughtfully
Begin with a service you use often and can recover through a trusted route. Sign in through the official app or type its known address, open the account's security settings, and look for an option to create a passkey. Follow the platform prompt and read what it says about where the passkey will be saved. Before closing the setup page, confirm that a backup method still works and that you can identify the device or credential manager involved.
After setup, try a sign-in on another device only if the service offers that option and you understand the prompt. If it does not work, use the service's official help page instead of following a link from an unsolicited message. Keep your device software and browser current, use a screen lock, and remove passkeys from accounts when you retire or lose a device. These simple habits make a new sign-in method easier to manage.
It is also reasonable to keep using a password where passkeys are not available or do not fit your situation. The goal is not to convert every account in one sitting. Start with high-value accounts, make recovery part of the setup, and learn how your particular ecosystem handles synchronization and lost devices. Passkeys can make routine sign-ins simpler while reducing exposure to common password phishing, provided the rest of the account and its recovery paths receive attention too.
Sources
[1] FIDO Alliance, Passkeys - https://fidoalliance.org/passkeys/
[2] Google Account Help, Sign in with a passkey instead of a password - https://support.google.com/accounts/answer/13548313?hl=en