Passkeys.

What Is a Passkey?

FIDO Alliance defines a passkey as an authentication credential based on FIDO standards. It can be stored on your phone or computer, or in a hardware security key. Passkeys are meant to replace passwords.

What Happens When You Sign in With a Passkey?

You approve a sign-in the same way you open your device. That can be a fingerprint, a PIN or a pattern. FIDO Alliance says passkeys build on the FIDO2 standards, including WebAuthn and CTAP, and use standard public key cryptography.

Public key cryptography uses a pair of linked keys instead of a shared secret.

FIDO Alliance also says passkeys can be securely synced across a user’s devices by a passkey provider, such as a browser, an operating system or a third-party app.

Why Are Passkeys Phishing-Resistant?

FIDO Alliance says passkeys use standard public key cryptography to provide phishing-resistant authentication. The UK National Cyber Security Centre (NCSC) says passkeys cryptographically bind authentication to the legitimate service. It also says traditional multi-factor authentication stays vulnerable to phishing because secrets or approvals can be observed and relayed during a live session.

CISA says some forms of MFA are vulnerable to phishing, push bombing, SS7 weaknesses and SIM swap attacks. It says FIDO/WebAuthn authentication is resistant to phishing, and that push bombing, SS7 and SIM swap attacks are not applicable to it.

Passkeys do not remove risk from the identity provider around them. Pocket ID verified-email flaw CVE-2026-115770 shows an OIDC passkey provider publishing an email as verified when the user never proved it.

What Does a Passkey Look Like in Practice?

This is a simple illustration. A site offers a passkey. You create it once on your phone. Later, the site asks you to sign in, and your phone asks for your fingerprint or PIN. You never type a password.

What Do Official Bodies Recommend?

The NCSC recommends passkeys over passwords wherever they are available. Where they are not, it says to keep a strong password and two-step verification.

CISA calls phishing-resistant MFA the gold standard and strongly urges organizations to adopt it. It says that while any form of MFA is better than none, some forms are vulnerable to phishing, push bombing, SS7 and SIM swap attacks.

How Do You Start Using Passkeys?

The NCSC guide to passkeys gives a short path for everyday users.

1. Use your device credential managerUsually the built-in one, such as Apple Passwords, Google Password Manager or Samsung Pass.
2. Look for passkey promptsCheck the account security or privacy settings of existing accounts for an offer to upgrade.
3. Choose a passkey on new accountsThe NCSC says you can start right away when you create an account.
4. Approve with your usual unlockThe credential manager checks it is you, with the face, fingerprint or PIN you already use.
5. Keep a strong password where neededIf a site has no passkeys, use a generated password and two-step verification.

The NCSC adds that the credential manager can back up your passkeys and sync them to other devices you trust.

Is a Passkey the Same as a Password?

No. A password is a secret that you type and that a site can store. A passkey uses a key pair, and you approve it with your device fingerprint, PIN or pattern.

Is a Passkey Multi-Factor Authentication?

It can be. The NCSC says FIDO2 credentials combine something the user has, the cryptographic key, with something they are or know when user verification takes place. That makes them multi-factor authentication. CISA also says FIDO authentication can include other factors, such as biometrics or PIN codes.

Where Are Passkeys Stored?

CISA says WebAuthn authenticators can be separate physical tokens, called roaming authenticators, connected over USB or near-field communication. They can also be built into laptops or mobile devices, called platform authenticators. FIDO Alliance adds that a passkey can live on a phone, a computer or a hardware security key.

Which Terms Sit Next to Passkeys?

Related terms include multi-factor authentication, password managers and account takeover.