Buhata
Login Start for Free

Home › Life Terms

Tech and digital life for families

Passkey

A sign-in method that replaces a password with a key stored on your phone, computer or security key, which you unlock with your face, fingerprint or screen PIN.

What It Means

A passkey is a sign-in credential built on standards from the FIDO Alliance, an industry group working to reduce reliance on passwords. It lives on your phone or computer, or on a hardware security key, and you use it the same way you unlock that device: a fingerprint, a face scan, a PIN or a pattern. Each passkey is tied to the one site or app it was made for, so a look-alike site can't use it, and Apple, Google and Microsoft all support passkeys on their platforms.

Try It: Compare a Password and a Passkey

Switch between the two and compare how each one signs you in, based on the FIDO Alliance, Apple and Google.

QuestionAnswer
What do you do to sign in?Type a secret you remember or saved
Who makes it?You, so it can be weak or reused
Can a fake site trick you into handing it over?Yes, that's what phishing tries to do
Does the site keep a copy of your secret?The site checks a secret you share with it

Tap Passkey to see the other side.

How People Say It

  • "It asked if I wanted to make a passkey, so I said yes."
  • "I just use my face to get into my email now."
  • "No password? How does that even work?"

The Breakdown

How to start using passkeys

  1. Start with your most important account, such as your email or your Google Account. Google lets you sign in with a passkey using your fingerprint, a face scan or your screen lock.
  2. On an iPhone, check that iCloud Keychain and two-factor authentication are on. Apple says both are needed, and that your passkeys then work on every device signed in to the same Apple Account.
  3. When a site or app offers to create a passkey, accept it and confirm with your face, fingerprint or device PIN.
  4. Next time, tap the account name field on the sign-in screen, pick the suggested account and confirm, the way Apple Support describes it on iPhone.
  5. Add passkeys to other accounts as they offer them.

Short version to try today. Open your email account's security settings and look for a passkey option. If it's there, set one up on the phone you carry every day.

Buhata's suggestion. Since a passkey opens with your device's screen lock, treat that PIN or pattern like a password and keep it to yourself.

Good to Know

Apple says passkeys saved in iCloud Keychain are encrypted, and nobody can see them, Apple included. Google notes that if your account uses 2-Step Verification, signing in with a passkey covers that second step, since it shows you have the device. The FIDO Alliance describes passkeys as resistant to phishingPhishingA scam where someone sends an email or text that looks like it's from a company you trust, to trick you into giving up passwords, account numbers or other details. See more because each one works only with the service it was created for.

FAQ

Is a passkey safer than a password?

The FIDO Alliance says passkeys resist phishing, are always strong and involve no shared secret, because each one is generated by your device and tied to one site or app. A password can be guessed, reused or typed into a fake site.

What happens if I get a new phone?

On Apple devices, passkeys stored in iCloud Keychain work on any device signed in to the same Apple Account, according to Apple Support. For other devices, check the help pages for the platform that saved your passkeys.

Do I still need a password if I have a passkey?

That depends on the account, so check its security settings. Google says a passkey lets you sign in with your fingerprint, face scan or screen lock instead of typing a password, and that it also stands in for the 2-Step Verification step.

Do It in Buhata

Reminders

Set a Reminder in Buhata for this weekend to add a passkey to your email account, then one more account each week after.

Open Buhata

Related Terms and Categories

  • Phishing

    A scam where someone sends an email or text that looks like it's from a company you trust, to trick you into giving up passwords, account numbers or other details.

  • Scam texts

    Text messages sent by scammers, often posing as a bank, a delivery company or a prize offer, to get you to click a link, pay money or share personal details.

  • Identity theft

    When someone uses your name, account details or other personal information without permission to open accounts, make charges or commit other fraud.

Tech and digital life for families

Sources

FIDO Alliance, "FIDO Passkeys: Passwordless Authentication"; Apple Support, "Use passkeys to sign in to websites and apps on iPhone"; Google Account Help, "Sign in with a passkey instead of a password"

Last updated .