TL;DR: A passkey replaces a password with a pair of cryptographic keys: the website keeps a public key, and the private key stays in your phone, computer or password manager, unlocked by your face, fingerprint or PIN. Because each passkey only works on the real site it was made for, passkeys are resistant to phishing, and there’s no password to leak in a breach. They can still be undermined by malware, stolen sessions or weak account recovery. Lose your phone and synced passkeys come back with your Apple, Google or password manager account. And since 2026, you can move passkeys between managers on iOS 26 and Android 14+ using the FIDO Credential Exchange standard.
Last updated: October 6, 2026. Checked against FIDO Alliance, Apple, Google, Microsoft and OWASP documentation.
Passkeys are suddenly everywhere. Microsoft made them the default sign-in for its Entra ID work accounts on September 1, 2026, and Google, Apple, Amazon and PayPal all support them. Yet a lot of people don’t trust them, mostly because nobody explains what’s actually happening when your phone says “Sign in with a passkey?”
This is passkeys explained in plain English: what they are, how they compare with passwords, whether they can be hacked, and what happens when you lose a device or switch password managers.
What is a passkey, in plain English?
A passkey is a login that uses a secret stored on your device instead of a password you type. When you create one, your device makes two linked keys. As Apple explains, “One of these keys is public, and is stored on the server… The other key is private, and is what is needed to actually sign in. The server never learns what the private key is.”
When you sign in, the site sends a challenge, your device signs it with the private key after you unlock it with Face ID, a fingerprint or your PIN, and the site checks the signature with the public key. Nothing reusable crosses the internet. Passkeys are built on the FIDO Alliance and W3C WebAuthn standards, so the same passkey system works across Apple, Google, Microsoft and third-party password managers.
Passkey vs password: which is safer?
Passkeys are safer for almost everyone, because they can’t be phished, guessed or reused.
| Password | Passkey | |
|---|---|---|
| What the site stores | A hash of your password | A public key (not secret) |
| Can it leak in a data breach? | Yes, and hashes can be cracked | Leaked public keys can’t be used to sign in |
| Phishing | Easy to type into a fake site | Only works on the real site’s domain |
| Reuse across sites | Common | Impossible: one key pair per account |
| Strength | Depends on you | Always strong |
| Unlock method | Typing it | Face, fingerprint, PIN or security key |
The phishing point is the big one. A passkey is tied to the website’s domain, so if a scam page at a look-alike address asks for it, your device simply has no passkey for that site. The FIDO Alliance calls passkeys “always strong and phishing-resistant.”
They’re easier, too. Microsoft reported in May 2025 that passkey users succeed at signing in about 98% of the time versus 32% for password users, and that passkey sign-ins are “eight times faster than a password and multifactor authentication.”
Can passkeys be hacked or stolen?
The passkey itself is very hard to steal, but your account can still be attacked around it. The OWASP Passkey Security Cheat Sheet lists what passkeys don’t prevent on their own, including “a compromised authenticated session from adding an attacker-controlled passkey” and “an insecure recovery process from bypassing passkey authentication.”
In practice, the realistic risks are:
- Malware on your device. If an attacker controls your unlocked computer, they can ride your logged-in sessions or steal session cookies. Passkeys don’t fix an infected PC.
- Weak recovery. If a site still lets you reset access with a text message or a guessable email, attackers go for that instead. Turn off password and SMS fallbacks where a site allows it.
- Your cloud account. Synced passkeys are only as safe as the Apple Account, Google Account or password manager that holds them. Protect those with a strong password and two-factor authentication.
- Social engineering. Scammers may try to talk you into approving a sign-in on another device. Only approve a QR code or prompt you started yourself.
Keeping your devices patched matters as much as the login method. Our note on the iOS 26.7.1 security update is a good example of why.
What happens if I lose my phone?
If your passkeys are synced, you get them back by signing in to the same account on a new device.
- Apple: passkeys sync through iCloud Keychain, which Apple says is end-to-end encrypted and “recoverable even if the user loses all their devices.” Recovery needs your Apple Account password, a verification code and a device passcode, with limited attempts, per Apple’s security page.
- Google: passkeys in Google Password Manager are end-to-end encrypted. On a new device you need your Google Password Manager PIN or your old Android phone’s screen lock, according to Google.
- Password managers such as 1Password and Bitwarden sync passkeys through your vault, so a new device just needs your vault login.
The exception is a device-bound passkey, such as one stored only on a hardware security key. Lose that and the passkey is gone, so always register a second key or keep another sign-in method for important accounts.
Can you share a passkey?
Yes, on Apple devices, through shared groups in the Passwords app. Apple’s iPhone guide covers sharing passwords and passkeys with people you trust: everyone in a group can use the shared logins, and changes sync to all members. 1Password also lets you share passkeys through shared vaults. You can’t send a passkey as text the way you’d text a password, which is the point.
Can I move passkeys between Apple, Google and a password manager?
Yes. Since 2026, the FIDO Credential Exchange Protocol (CXP) lets you move them securely. Until recently, passkeys were stuck wherever you made them. That changed in two steps:
| Platform | How to move passkeys | Requirements |
|---|---|---|
| iPhone, iPad, Mac | Export from Apple Passwords or a supporting app, import into another | iOS 26 / macOS 26 and a supporting app |
| Android | Start an import in the new password manager; Android hands off to the old one | Android 14+ and Google Play Services 26.21+ for passkeys |
| Supported apps | Apple Passwords, Google Password Manager, 1Password, Bitwarden, Dashlane and others | Varies by app |
Google announced the Android version on September 10, 2026, saying it works with Google Password Manager, 1Password, Bitwarden and Dashlane, “with more partners to follow.” Before this, “passkeys couldn’t be transferred at all,” as Google put it. Bitwarden says CXP was built with Apple, Google, Microsoft, 1Password and others.
Moving between ecosystems (iPhone to Android) still usually means a cross-platform manager. The simplest fix is to keep your passkeys in 1Password, Bitwarden or Google Password Manager, which work on both.
Passkey vs password manager: do I still need one?
Yes, most people still need a password manager, and it’s now the best place to keep passkeys too. Many sites still use passwords, and some only allow a passkey alongside one. A good manager stores both, fills them on every device, and with CXP you’re no longer locked in. If you live entirely in Apple’s or Google’s world, their built-in managers are fine.
Passkeys vs authenticator apps and SMS codes
Passkeys beat both, because codes can be phished and passkeys can’t. A six-digit code from an app or a text message can be typed into a fake site and relayed to the real one in real time. A passkey can’t. SMS has its own problems, which is partly why Microsoft says “SMS and voice are no longer positioned as secure authentication methods” for Entra ID, with Microsoft-provided SMS and voice sign-in retiring from February 1, 2027. Keep an authenticator app for sites that don’t offer passkeys yet.
Verdict: should you switch to passkeys?
Yes. Create passkeys for your most important accounts first: email, Apple or Google, Microsoft, your bank and your password manager. Save them in a manager that syncs across all your devices. Then lock down recovery: strong password and two-factor authentication on the account that stores the passkeys, and a backup method you control. If you’re on a Windows PC, make sure it’s on a supported version too. Our Windows 11 24H2 end of support guide explains what to check.
FAQ
What is a passkey?
A passkey is a sign-in credential made of two cryptographic keys. The website stores a public key, and your device keeps the private key, which you unlock with your face, fingerprint or PIN.
Are passkeys safer than passwords?
Yes. They can’t be guessed, reused or typed into a phishing site, and a breach of the website’s database doesn’t expose anything an attacker can sign in with.
Can passkeys be hacked?
The passkey itself is very hard to steal, but attackers can still target malware-infected devices, stolen session cookies, weak account recovery, or the cloud account where your passkeys sync.
What happens to my passkeys if I lose my phone?
Synced passkeys come back when you sign in to the same Apple Account, Google Account or password manager on a new device. Passkeys stored only on a security key are lost with it.
Can I move passkeys from iPhone to Android?
Apple-to-Google transfer isn’t direct. Store passkeys in a cross-platform manager like 1Password, Bitwarden or Google Password Manager, or use Credential Exchange on iOS 26 or Android 14+ to move them into one.
Do I still need a password manager with passkeys?
Most people do. Plenty of sites still use passwords, and a manager stores passwords and passkeys together and syncs them across all your devices.
Sources checked October 6, 2026. Passkey support changes quickly; we’ll update this guide as platforms add features.
