Passkeys for Everyone: Sign In Safely Without Passwords

Passwords get guessed, reused and typed into fake websites; passkeys fix all three, but many people are unsure what happens to them when a phone is lost or shared. A passkey lets you sign in with the same face, fingerprint or PIN you use to unlock your phone or computer, and it cannot be handed to a scam website because it only works on the real site it was made for. The UK's National Cyber Security Centre now recommends making passkeys your first choice of login wherever they are offered. This guide explains in plain language what a passkey is, where it is stored, how to set one up on Apple and Google, what to do if you lose a device, and the questions people most often get stuck on, such as using a shared family computer. It is for individuals and families, and for the IT, awareness and customer support teams who help them. Our enterprise view is in the Passwordless and Passkeys Guide.

Key takeaways

Use passkeys wherever you are offered them. The NCSC recommends them as your first choice of login; for accounts without passkeys, keep a strong, unique password and two-step verification.
A passkey cannot be phished like a password. There is nothing for you to type or read out, and it only works on the website or app it was created for.
Where it is saved decides what happens if you lose a device. Passkeys synced by Apple, Google or a password manager survive losing a phone; one saved only on a single computer or security key does not.
Anyone who can unlock the device can use its passkeys. Google advises not creating passkeys on shared devices; keep your phone's screen lock to yourself.
Keep a way back in. Passkeys work best alongside recovery options such as a second device, backup codes or a recovery contact.

What a passkey is, in plain terms

A passkey is a digital key made by your device for one particular account. The FIDO Alliance, which publishes the standard, describes it as a credential stored on a phone, computer or security key that lets you sign in using the same method you use to unlock the device.

Two halves: when you create a passkey, your device makes a matching pair of keys. The website keeps one half, which is useless on its own; the other half stays protected on your device or in your password manager. Apple notes the private half is never shared with the website.
Your face or fingerprint stays with you: when you sign in, your device checks your face, fingerprint or PIN locally. Only the result, "yes, it's them", is used to sign in; your biometric data is not sent to the website.
Tied to the real site: a passkey made for your bank will not work on a look-alike website set up by a scammer, so a phishing link cannot trick you into handing it over.
Nothing to leak: because the website only holds the public half, a data breach at the website does not expose something criminals can use to sign in as you.

Question	Password	Password plus text code	Passkey
Can you be tricked into typing it on a fake site?	Yes	Yes, both parts	No
Is it useful to criminals if the website is breached?	Often	Password part often is	No
Do you need to remember anything?	Yes	Yes	Only your device unlock
Can it be reused on other sites?	Often is	Often is	No: one passkey per account
What if you lose your phone?	Still works elsewhere	Need your number back	Works on your other synced devices

Where your passkeys live

This is the part that decides whether losing a phone is a nuisance or a lockout. There are two kinds: synced passkeys, which are backed up and available on all your devices signed in to the same account, and device-bound passkeys, which stay on one device or one security key.

Where it is saved	Available on	If you lose the device	Good for
Apple Passwords and iCloud Keychain	Your Apple devices signed in to the same Apple Account; Apple says syncing is end-to-end encrypted	Still on your other devices; can be recovered through iCloud Keychain recovery	Most iPhone, iPad and Mac users
Google Password Manager	Android phones and Chrome signed in to the same Google Account; Google says they are backed up and synced	Still available on other devices; a Google Password Manager PIN helps recover them on a new device	Most Android and Chrome users
A third-party password manager	Every device where you use that password manager	Still available after signing in to the password manager	People who mix Apple, Android and Windows devices
Windows Hello, or a browser profile on one computer	That computer only	Google says these cannot be synced or recovered if the computer is lost or reset	Second passkeys, not your only one
Hardware security key	Wherever you plug in or tap the key	Google says passkeys on a security key are not backed up; a lost key means those passkeys are gone	High-risk users, kept with a spare key

The FIDO Alliance says device-bound passkeys on modern security keys give the highest assurance, while synced passkeys trade a little of that for convenience and easy recovery. For most people, synced passkeys are the right choice. See the Hardware Security Keys Guide if you are considering keys.

Setting up your first passkeys

Lock your phone properly first. Google says you must have a screen lock on to create and use passkeys. Use a strong passcode, at least six digits, and face or fingerprint unlock.
Start with your main email account. For Google, go to myaccount.google.com/signinoptions/passkeys and choose Create a passkey, then unlock your device. On an Android phone signed in to your Google Account, a passkey may already have been created for you. On Apple devices, keep two-factor authentication on for your Apple Account; passkeys you accept on other sites are saved to Apple Passwords and synced through iCloud Keychain.
Accept the offer on other important sites. Many banks, shops and social networks now offer to "create a passkey" after you sign in, or in their security settings. Say yes, and let your phone or password manager save it.
Add a passkey on a second device if it does not sync automatically, such as a work laptop with a different account or a Windows PC, so you are never down to one.
Keep your recovery options current. Recovery phone, recovery email and backup codes still matter, because they are how you get back into the account that stores your passkeys. See the Account Recovery Planning Guide.

Signing in on someone else's computer

You do not have to save a passkey on a computer you do not own. On the sign-in page, choose an option such as "Use a phone or tablet" or "Try another way", and a QR code appears. Scan it with your phone, approve with your face or fingerprint, and you are in. Google notes the passkey stays on your phone, and Bluetooth needs to be on because the FIDO cross-device method checks that the phone is physically nearby. That proximity check is part of why a scammer cannot use the method remotely.

Lost phone, new phone, shared device

Lost or stolen phone: synced passkeys are still on your other devices. From one of them, remove the lost device: Google suggests removing the passkey created on that device, or signing the device out under Security and sign-in, Your devices. On Apple, mark the phone as lost in Find My. Then follow the Stolen or Lost Phone steps.
Lost every device: Apple says passkeys can be recovered through iCloud Keychain recovery, which asks for your Apple Account password, a code sent to your registered phone number and a device passcode, with a limited number of attempts. Google's PIN does a similar job for Google Password Manager. This is why recovery options matter.
New phone: sign in to the same Apple Account or Google Account, or your password manager, and your synced passkeys come with you. Check one or two important sites before you wipe the old phone.
Moving between Apple, Google and other managers: the FIDO Alliance publishes credential exchange specifications that define a standard format for moving passwords and passkeys between credential managers. Support varies, so for now the simplest approach is to add a new passkey in your new manager for each important account.
Shared family computers and tablets: Google advises creating passkeys only on devices you personally own and use, because anyone who can unlock a device can use its passkeys, even after you sign out. On a shared device, use the QR code method with your own phone instead.
Sharing an account with a partner: rather than sharing a phone passcode, give each person their own passkey on their own device, or use a password manager feature that shares chosen sign-ins with people you trust. Apple's Passwords app, for example, supports shared groups that can include passkeys.

Do I still need two-step verification?

The FIDO Alliance describes passkeys as removing the need for a password and additional factors, because a passkey already combines something you have (the device holding the key) with something you are or know (your face, fingerprint or device PIN). In practice, keep two-step verification switched on for now, for three reasons.

Other ways in still exist: most accounts keep a password or recovery route alongside the passkey. Two-step verification protects that route.
Your Apple or Google account protects your passkeys: Apple requires two-factor authentication for any Apple Account that uses iCloud Keychain, and the account that syncs your passkeys deserves the strongest protection you have.
Sites differ: some services ask for a passkey and a code, others only a passkey. Follow what each site offers rather than turning protections off.

Over time, as sites let you remove passwords entirely, the passkey becomes the main lock and your recovery options become the spare key. See the Two-Factor Authentication for Everyone Guide.

When passkeys are not the right fit yet

A site does not offer them: keep using a strong, unique password from a password manager with two-step verification, as the NCSC advises. See the Password Managers Explained for Everyone Guide.
You only have one device and no recovery options: set up recovery first, then passkeys.
Someone else knows your phone passcode: change the passcode before creating passkeys, especially if that person could misuse access. See the Technology-Facilitated Abuse Safety Guide.
An older relative who struggles with devices: passkeys are usually easier than passwords, but make sure a trusted family member is a recovery contact before relying on them.

Scams to watch for

Passkeys remove the most common trick, the fake sign-in page. Criminals then try to get around them in other ways.

"Use your password instead": a fake page may claim passkeys are not working and ask you to type your old password and a code. If a site you normally sign in to with a passkey suddenly asks for a password, stop and go to the site directly.
Codes read out over the phone: no genuine bank or tech company needs you to read out a code. Hang up and call back on a number you trust.
Requests to scan a QR code you did not start: only scan a passkey QR code that appears on a screen in front of you, on a sign-in you began yourself.
Remote access apps: anyone who controls your device can use it. Never install a screen-sharing app because a caller tells you to. See the Impersonation Scams Guide.

For organisations helping customers and staff

Banks, retailers, employers and community groups can speed adoption by explaining passkeys simply and supporting recovery well. Customer-facing teams should expect questions about lost phones and shared devices, and must never ask customers to read out codes.

Topic	NIST CSF 2.0	NIST SP 800-53 Rev 5
Offering phishing-resistant sign-in	PR.AA-03	IA-2 Identification and Authentication (Organizational Users)
Managing passkeys and lost authenticators	PR.AA-01	IA-5 Authenticator Management
Explaining passkeys in awareness programmes	PR.AT-01	AT-2 Literacy Training and Awareness

Measures that show it is working: share of active users with at least one passkey; share with passkeys on two or more devices or a synced provider; sign-ins completed with a passkey; account takeovers among passkey users against password users; and support calls about lost passkeys resolved without weakening recovery. For rollout detail see the Passkey Rollout Guide.

Common failure patterns

One passkey on one computer: a passkey saved only in Windows Hello or a single browser profile, lost when the computer is replaced or reset.
A single security key with no spare: lose it and every passkey on it is gone; always register a second key or a synced passkey too.
Passkeys on the family tablet: anyone who can unlock it can sign in as you.
Keeping a weak password as the fallback: if the old reused password is still accepted, criminals will target that instead. Change it to a strong, unique one, or remove it where the site allows.
Ignoring recovery: passkeys synced to an Apple or Google account are only as recoverable as that account.
Typing a password when a passkey should appear: the moment a familiar site asks for a password instead, treat it as a warning sign.

Practitioner checklist

Turn on a strong screen lock with face or fingerprint unlock on your phone.
Create a passkey for your main email account first.
Say yes when banks, shops and social networks offer a passkey.
Store passkeys in Apple Passwords, Google Password Manager or a password manager that syncs.
Make sure every important account has passkeys on at least two devices or a synced provider.
Do not create passkeys on shared devices; use the QR code method instead.
Keep recovery phone, email, backup codes and a recovery contact up to date.
Treat any unexpected password prompt on a passkey site as a possible scam.

Passkeys for Everyone Guide: Sign In Safely Without Passwords