Passkeys Explained: What Replaces Your Password

A passkey lets you sign in with the fingerprint, face scan, or PIN you already use to unlock your phone or laptop. There is no password to type, remember, or hand over to a fake login page. The credential lives on your devices, and the website holds only a public key that is useless on its own.

Underneath, it is a different model from passwords: instead of a shared secret that both you and the website know, a passkey is a pair of cryptographic keys where only one half ever leaves your device.

How a passkey actually works

When you create a passkey for a site or app, your device generates a unique key pair for that one account, according to the FIDO Alliance, the industry group behind the standard. The public key is sent to the service and stored there. The private key stays on your device, or on a hardware security key, and the service never learns it.

Signing in is a short challenge and response. The service sends a challenge, your device signs it with the private key after you approve with your biometric or PIN, and the service checks that signature against the public key it holds. No shared secret crosses the network, and a breached database reveals only public keys, which cannot sign anyone in.

Passkeys are built on FIDO2, which combines WebAuthn, the browser API that manages the credential, and CTAP, the protocol for talking to an authenticator such as a phone or security key. Two design details matter for ordinary use:

• One passkey, one site. A passkey is tied to the site or app it was created for. Google puts it plainly in its Chrome help: passkeys are connected to the app or website they were created for, so you cannot be tricked into using one on a fraudulent site. A password typed into a lookalike page works for an attacker; a passkey presented to one does not.
• Your face and fingerprint stay home. The biometric check happens on the device. The FIDO Alliance notes that biometric information stays on the device and is never sent to a remote server; the server receives only confirmation that the check succeeded. Google says the same: biometric data stays on your device and is never shared with Google.

A passkey also combines two things passwords kept separate: something you have, the device holding the private key, exercised by something you are or know, the biometric or PIN. That is why Google treats a passkey as enough to bypass the second step for accounts with 2-Step Verification. Adding one does not remove your existing password or recovery factors, which stay in place as fallbacks.

Synced passkeys and device-bound passkeys are not the same thing

Most confusion about passkeys comes from a distinction the sign-up prompt rarely explains.

A synced passkey is copied through a passkey provider to your other devices. The provider can be built into your platform, such as iCloud Keychain or Google Password Manager, or be a third-party password manager. Create a passkey on one device and it becomes available on the others signed in to the same provider account. The FIDO Alliance describes syncing as end-to-end encrypted, and Apple describes iCloud Keychain the same way, with strong keys Apple itself does not know.

A device-bound passkey never leaves a single device, or it lives on a FIDO security key. There is no cloud copy. That is stricter, and some workplaces prefer it for sensitive accounts, but the credential is only as available as that one object.

For most personal accounts, the passkey you create on a phone is a synced one. Knowing which kind you have is the whole answer to the lost-phone question.

What happens when you lose your phone

If your passkeys were synced, losing the phone is mostly an inconvenience. Set up the replacement device with the same provider, an Apple Account for iCloud Keychain or the same Google Account for Google Password Manager, and the synced passkeys arrive on the new device. The FIDO Alliance makes the point directly: on a new device set up with the same provider, passkeys are available from the first sign-in, not after a new registration for each site.

Apple goes further for the worst case. Apple says passkeys synced through iCloud Keychain are recoverable even if all devices are lost, through iCloud Keychain escrow. Recovery is deliberately strict: you authenticate with your iCloud credentials, respond to a text message sent to your registered phone number, and enter your device passcode. Apple allows only 10 attempts to retrieve the escrow record; after the tenth failed attempt the record is destroyed. You can also set up an account recovery contact in advance.

If a passkey was device-bound, the copy on the lost device is gone. Recovery then depends on what else the account has: a second passkey on another device or a security key, a password that is still enabled, or the service’s account-recovery process. The FIDO Alliance notes that a security key holding a device-bound passkey can itself act as a recovery credential when the synced devices are lost.

Two steps limit the damage either way, and both come from the providers’ own guidance:

1. Remove the lost device’s passkey from the account. Google’s instruction is direct: remove that passkey from your Google Account, and review the devices with access to the account. If the passkey also lives in a third-party manager, remove it there as well; deleting it in one place does not clear the other.
2. Do not worry that a finder can simply use your passkeys. A passkey cannot be used without unlocking the device, so whoever picks up the phone still faces the fingerprint, face scan, or PIN that protects everything else on it. That is also why Google warns in the other direction: only create passkeys on devices you personally own, because anyone who can unlock that device can use its passkeys.

One bridge while you wait for a replacement: a phone passkey can sign you in on a computer that does not have it. Cross-device sign-in shows a QR code on the computer, you scan it with the phone, and Bluetooth Low Energy verifies the phone is physically near the computer, which Google’s flow requires to be on.

Where passkeys stand in October 2026

Passkeys are available widely, but they have not displaced passwords yet. Dashlane’s 2026 Passkey Power 20 report, published this month and based on millions of aggregated, anonymized authentications from July 2025 through June 2026, measured passkeys at 28 percent of logins at Google, the highest share it found at any major domain. Even at the service that made passkeys the default for personal accounts in October 2023, roughly seven in ten logins in that measurement still did not use one. The same report counted 2.5 million passkey authentications per month among Dashlane users, with 57 percent of those users holding at least one passkey.

Requirements are now ordinary. Google lists support on computers running at least Windows 10, macOS Ventura, or ChromeOS 109, and phones running Android 9 or iOS 16 or later, in Chrome 109, Safari 16, Edge 109, or Firefox 122 or later, with a screen lock on. If a site offers no passkey option, Apple notes that means it does not currently support passkeys.

A few habits help:

• Start with accounts that protect other accounts: primary email, your Apple or Google account, and your password manager.
• Keep sync on, and check that a second device can see the passkey before you rely on it.
• Register a second passkey, on another device or a security key, for accounts you cannot afford to recover slowly.

Bottom line

A passkey replaces a shared secret you type with a private key that stays on your device and signs in only for the site it was created for, unlocked by the same check that unlocks your phone. If it is synced through iCloud Keychain, Google Password Manager, or another manager, losing your phone means signing in to the same provider on a new device and removing the lost device’s access, not rebuilding every account. If it is device-bound, recovery runs through a second registered passkey or the service’s normal recovery process. Check which kind you have for your main accounts now. Passkeys protect the sign-in itself; they do not hide your traffic from your network or internet provider, which is the separate question of what a VPN does and does not do.