Passkeys explained: what they are, how to turn them on and what happens if you lose your phone

October is Cybersecurity Awareness Month, and the Cybersecurity and Infrastructure Security Agency launched its 2026 campaign on Oct. 1 under the theme "Securing the Next 250." This year's CISA campaign is aimed mainly at organizations that run critical infrastructure, but two of its basics, strong passwords and multifactor authentication, apply to everyone. Passkeys are a newer way to sign in that can replace the password altogether, and the major tech platforms now support them.

What a passkey is

The FIDO Alliance, the industry group behind the standard, describes a passkey as a sign-in credential that replaces passwords with cryptographic key pairs. Instead of typing a secret, you sign in the same way you unlock your phone or computer: with a fingerprint, a face scan or a device PIN.

Here is what happens behind the scenes, according to Microsoft's passkeys overview. When you create a passkey, your device generates two keys. The public key is registered with the website or app. The private key stays with you. When you sign in, your device proves it holds the private key without sending a password over the internet.

Your fingerprint or face data does not go to the website. The FIDO Alliance says biometric information and processing stay on the device and are never sent to a remote server. The biometric step only unlocks the passkey on your own device.

Why passkeys resist phishing

A password can be typed into a fake login page. A passkey cannot be handed over that way. Microsoft explains that each passkey is associated with the specific domain the website or app registered, so a look-alike site cannot receive it. Apple's security overview adds that the public key stored on the server is not a secret, and the server never learns what the private key is.

That is why security agencies rank this kind of sign-in highly. CISA's mobile communications guidance, written for people at high risk of being targeted, calls FIDO authentication the strongest form of multifactor authentication. It says hardware security keys are the most effective option where feasible and FIDO passkeys are an acceptable alternative. It also says codes from authenticator apps are better than text messages but still vulnerable to phishing.

Synced passkeys and single-device passkeys

Passkeys come in two forms. The FIDO Alliance says they can be synced across your devices or bound to one device.

• Synced passkeys are copied to your other devices through a passkey provider, such as a password manager. Apple, for example, syncs passkeys through iCloud Keychain, which it says is end-to-end encrypted with keys not known to Apple.
• Device-bound passkeys live on one phone, computer or hardware security key. Microsoft says a passkey saved with Windows Hello is stored locally on that Windows device.

You can also use a passkey on a device that does not have it. The FIDO Alliance says cross-device sign-in lets you scan a QR code with your phone to log in on a laptop.

How to turn on passkeys

You can only create a passkey for a site or app that supports it. Many services offer the option in their account or security settings, or prompt you after you sign in.

Google Account

Go to myaccount.google.com/signinoptions/passkeys and select Create a passkey, then unlock your device. Google's help page lists the minimums as Windows 10, macOS Ventura or ChromeOS 109 on computers, and Android 9 or iOS 16 on phones, with a screen lock turned on.

Apple devices

On an iPhone, Apple's user guide says iCloud Keychain and two-factor authentication must be turned on. Sign in to a supported app or website, and when you see the option to save a passkey, tap Continue. The passkeys you create are stored in the Passwords app, and you can also save one to a hardware security key. You sign in with Face ID, Touch ID or your device passcode.

Microsoft account

Microsoft's instructions say to sign in to your account's Advanced Security Options at account.live.com/proofs/manage, choose Add a new way to sign in or verify, then select Face, Fingerprint, PIN, or Security Key and follow the prompts. You can save the passkey to a synced password manager, a phone, a security key or Windows Hello on that PC.

What happens if you lose your phone

This is the question that matters most, and the answer depends on where your passkeys are stored.

• If they are synced, they remain on your other devices that use the same provider. Apple says passkeys in iCloud Keychain can be recovered through its keychain escrow even if you lose all your devices, and it suggests setting up an account recovery contact.
• If they live on one device, Microsoft is blunt: "If you lose the device, you lose the passkey unless you have another recovery method." It recommends a synced credential manager or creating passkeys on your other devices as a "digital spare key."
• Remove the lost device's passkey. Google says to sign in on another device and remove the passkey belonging to the lost or stolen one.
• Consider a backup key. The FIDO Alliance says a hardware security key can act as a recovery credential if you lose access to your other devices.

Before you rely on passkeys, check that each important account, especially your email, has a recovery method you control. Some services keep your password as a fallback after you add a passkey; Apple notes that a passkey and a password can exist for the same account.

Passkeys will not fix every security risk, and setup steps change as companies update their software. Check the help pages of the services you use for the current instructions.