Accounts & passwords
What is a passkey, and should I use one?
A passkey lets you sign in with your fingerprint, face or phone PIN instead of a password. It sounds like a convenience feature, and it is, but the bigger benefit is security. A passkey only works on the real website it was made for, so a fake sign-in page can’t steal it.
The short version
Quick answers
- A passkey replaces your password with your phone or computer’s unlock.
- It can’t be phished or reused on another site.
- Google, Apple, Microsoft, myGov and many others support them.
- Start with your most important accounts.
How a passkey works, without the jargon
When you create a passkey for an account, your device makes a matched pair of digital keys. One stays securely on your device (or in your password manager). The other is stored by the website. When you sign in, the website asks your device to prove it holds the matching key, and you approve that with your fingerprint, face or PIN.
What that means in practice:
- There’s nothing to remember or type. You just unlock your device.
- There’s nothing to steal from the website. If the site is breached, the part it holds is useless on its own.
- It can’t be used on a fake site. A passkey is tied to the real website’s address. A look-alike phishing page simply won’t receive it.
- You can’t be tricked into reading it out. Unlike a code, there’s nothing to share.
Where you can use them
Support is growing quickly. Examples include:
- Google, Apple and Microsoft accounts
- myGov, which lets you sign in with a passkey and then turn off your password as a sign-in option
- Many password managers, banks, shopping sites and social media platforms
Look in an account’s Security or Sign-in settings for Passkeys.
Setting one up
Find the passkey option
Sign in to the account normally, then go to its security or sign-in settings and choose to create a passkey.
Approve on your device
Your phone or computer will ask you to confirm with your fingerprint, face or PIN, and choose where to save the passkey. Saving it to your phone’s built-in password manager or a cross-device password manager means it syncs to your other devices.
Test it
Sign out and back in using the passkey to check it works.
Keep a backup way in
Keep another sign-in method or recovery option set up, in case you lose your device. Many services let you add passkeys on more than one device.
On a shared or borrowed computer
You can usually sign in by scanning a QR code with your phone, which then approves the sign-in. The passkey never leaves your phone.
Things to know
- Where it’s saved matters. A passkey saved to Apple’s or Google’s password manager syncs across devices on that platform. A cross-platform password manager can sync passkeys across Apple, Windows and Android.
- Losing your phone isn’t a disaster if your passkeys are synced and you can sign in to your Apple, Google or password manager account on a new device.
- Not every site supports them yet, so you’ll still need a password manager for the rest.
For businesses
Passkeys and security keys are the strongest protection against phishing for staff accounts, especially administrators. Microsoft 365 and Google Workspace both support them. If your team is regularly targeted by phishing, moving admins and finance staff to passkeys first gives the biggest benefit for the effort.
Common questions
If someone steals my phone, can they use my passkeys?
Not without unlocking the phone with your fingerprint, face or PIN. Use a strong phone PIN, not something like 1234.
Does the website get my fingerprint?
No. Your fingerprint or face only unlocks your own device. It never gets sent to the website.
Can I go back to passwords?
Usually yes. You can remove a passkey in the account settings, although keeping it is safer.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.