What is a passkey?
A passkey is a unique digital key that replaces your password.
Passkeys let you sign in quickly and securely without creating, remembering, or typing a password. When you sign in with a passkey, your device first verifies it's you using your face, fingerprint, or device PIN.
One key stays with you
That key stays with you and isn't shared with the website.
The website gets the linked key
The website stores the linked key, but it can't be used to sign in by itself.
They work together
When you sign in, your device uses its key to prove it's really you. No password is ever sent or stored.
Technical detail
Under the hood: asymmetric cryptography
Passkeys use public key cryptography, similar to SSH keys. The private key is generated in a credential manager or in a hardware authenticator's secure element. The public key, along with some additional WebAuthn-specific metadata, is sent to the server. However the public key is mathematically useless without the private key to sign challenges with. The server never sees or stores anything secret.
Using passkeys
How you use passkeys to sign in
Using a passkey is simple. Once you've created one, signing in only takes a few seconds.
Create a passkey
Your credential manager creates a unique pair of keys, your passkey, for the website or app. One part of the passkey is shared with the website. The other part remains securely stored in your credential manager on your device to prove it's you. Your part is never shared or stored by the website or app.
Confirm it's you
The next time you sign in, your device asks you to verify it's you using your face, fingerprint, or device PIN. Your biometric, if used, never leaves your device and is never shared.
You're signed in!
Your device securely proves it's you to the website, without ever sending a password over the internet.
Every passkey is unique
Every service you use gets its own unique passkey. A passkey created for your bank works with your bank (website or app) and nowhere else. A passkey created for your email works the same way, for your email only. Because each passkey belongs to one service, there's nothing to steal and reuse anywhere else.
This also protects your privacy: since each service only ever sees the passkey made for it, there's no shared identifier that could be used to track or link your activity across different sites.
Technical detail
The cryptographic handshake
To confirm its you, the service (app or site) sends a challenge during the sign in process. The credential manager/authenticator signs this challenge using the passkey's private key. The signed response includes this signature as well as additional context about the session, such as the origin, and whether the request was made in an embedded context (iframe). The server verifies that (1) the origin is the expected value (e.g. bank.com not fake-bank.com), (2) the challenge matches the one it issued, and (3) the signature is valid for the stored public key. The signed origin match is the primary way that passkeys (and WebAuthn credentials in general) resist phishing.
The password problem
Why passwords keep failing
Passwords have been around for decades, but they weren't designed for today's internet. As online threats have evolved, we've tried to make passwords more secure by adding text message codes to enter, email links to click on, and asking you to perform other extra steps to prove you're allowed to sign in. While these can help in some situations, they don't solve the underlying problem: passwords themselves are a terrible way to prove who you are.
Passwords get reused
Many people reuse passwords across multiple accounts. If one website is compromised, attackers often try the same password on other websites.
Passwords can be stolen
Websites store password information that attackers target during data breaches. Once stolen, passwords can be cracked and then used by those attackers.
Phishing is the most common attack that leads to stolen accounts and identity theft. Attackers create fake websites that look like legitimate ones, tricking people into entering their passwords and even their verification codes.
Passwords slow you down
Remembering passwords, resetting forgotten passwords, waiting for text messages, and checking your email all add friction to something you do every day.
Passkeys were designed to solve these problems.
Technical detail
The root problem
Passwords are shared secrets: you know it, and the server stores it. That means there are two places they can be stolen: from you (phishing) and from the server (data breaches). Any authentication scheme based on shared secrets has this fundamental weakness.
Understanding phishing
What is phishing?
Criminals build websites that look identical to real ones, like your bank, your email, or your favorite store. They trick you into visiting the fake site and typing in your password. Then they use your password on the real site to log in as you. Phishing is the most common way that accounts and identities get stolen online, and it works on passwords, verification codes, and text messages alike.
Real site vs fake site
With a passkey, this doesn't work!
Your passkey is permanently tied to the exact website where you created it, so it simply won't respond on a lookalike site — not a typosquat, not a redirect. There's nothing to type, so there's nothing the attacker can steal.
Passkey works perfectly
Passkey refuses to work
You
FAKE SITE
bank-secure-login.com
Attacker
has your password
Real Site
bank.com
Now signed in as you!
Technical detail
Why traditional MFA doesn't fully protect you
Real-time phishing attacks (also called "adversary in the middle") can intercept SMS OTP codes, TOTP codes, and even push notifications in real time. The attacker's fake site relays your credentials to the real site instantly, including the second factor. This is why FIDO2/WebAuthn was designed specifically to address this. WebAuthn credentials, including passkeys, are scoped to a specific domain.
During a registration ceremony, this is declared as the Relying Party ID (RP ID), which is saved with the passkey in the credential manager. During an authentication ceremony, the RP ID is used by the browser, app, and/or OS to select the appropriate passkey for the service. But this is not what provides the primary phishing protection! The service's calling origin is signed over by using the passkey's private key. This origin can then be checked by the service on their backend to ensure it's what they expected. If the origin is not an expected value, the request is rejected and no session is established. The origin is often the web origin (e.g., https://login.example.com), but can also be an app identity for native apps.
The passkey advantage
Why passkeys win
Better than password with SMS. Better than magic links.
Password
Password + SMS
Magic Link
Passkey
Technical detail
Credential stuffing & server-side breach protection
In a credential stuffing attack, attackers take username/password pairs leaked from one site and try them on others. Passkeys eliminate this entirely: there's no secret to stuff. On the server side, only the public key is stored. Even if a server is fully compromised, the attacker gets a list of public keys, which are mathematically useless for signing in. The corresponding private key never left your credential manager.
Storing passkeys
Where do I store my passkeys?
Your passkeys are stored in a credential manager, an app or service that syncs them securely across your devices, similar to how your photos or contacts stay available everywhere you're signed in.
Most people already have one. Android users have Google Password Manager or Samsung Wallet (Pass), iPhone users typically have Apple Passwords, and Windows users may have Microsoft Password Manager. You can also use a third-party option like 1Password, Dashlane, or Bitwarden.
The big benefit: create a passkey once, and it's available on all your devices. No need to set it up again on each device.
1Password
Independent credential manager with passkey support. Works across Android, iOS, Linux, macOS, and Windows devices.
Apple Passwords
Built into iPhone, iPad, and Mac. Syncs via iCloud Keychain using your Apple Account.
Bitwarden
Independent, open-source credential manager with passkey support. Free and self-hosted versions available. Works across Android, iOS, Linux, macOS, and Windows devices.
Dashlane
Independent credential manager with passkey support. Works across Android, iOS, Linux, macOS, and Windows devices.
Google Password Manager
Built into Android and Chrome. Syncs across devices using your Google account. Works across Android, iOS, Linux, macOS, and Windows devices.
KeePassXC
Independent, open-source, offline-first credential manager with passkey support. Works across Linux, macOS, and Windows, with community-built companion apps for Android and iOS.
Keeper
Independent credential manager for individuals and businesses with passkey support. Works across Android, iOS, Linux, macOS, and Windows devices.
LastPass
Independent credential manager with passkey support. Works across Android, iOS, Linux, macOS, and Windows devices.
Microsoft Password Manager
Built into Microsoft Edge and Windows. Syncs across devices using your Microsoft account. Works across Android, iOS, Linux, macOS, and Windows devices.
NordPass
Independent credential manager from Nord Security with passkey support. Works across Android, iOS, Linux, macOS, and Windows devices.
Proton Pass
Independent, end-to-end encrypted credential manager from Proton with passkey support. Works across Android, iOS, Linux, macOS, and Windows devices.
Samsung Wallet (Pass)
Samsung Pass is integrated into Samsung Wallet, which is built into Samsung Galaxy devices. Syncs across your Samsung Galaxy Android devices using your Samsung account.
Choosing a credential manager
Which credential manager is right for me?
Pick the credential manager that's right for you. Whether you choose the one built into your devices or a third-party app, passkeys are built on open standards, so websites and apps can support them regardless of which credential manager you use.
We've scored each credential manager below, ranked from highest to lowest overall grade. See the Scoring Criteria section for our full scoring methodology.
Scores last updated Sep 22, 2026.
Additional Info
- KeePassXC
- KeePassXC isn't a service with built-in sync or sharing: it's an app that produces and consumes a database file, so features like E2EE, family sharing, and migration aren't provided by KeePassXC itself but depend entirely on how you choose to store and sync that file (e.g., a plain folder, a personal cloud drive, or a self-hosted solution). That flexibility is why it earns a neutral rating for some items: you get exactly the level of security and convenience you're willing to configure yourself.
Scoring criteria
What each criterion measures
Here's what we're actually looking at behind each score, and what separates a top score from a low one. Scores combine hands-on testing with each vendor's public documentation. Features that require an organizational or managed deployment (not practical to test directly) are assessed from published documentation instead.
Works where you doEcosystem AvailabilityCore
Can you actually use this credential manager everywhere you need it, like on your phone, your computer, your tablet, and in the apps and browsers you use? A top score means it has native apps for all the major platforms and works smoothly in all the major browsers. A low score means it's mostly locked to one company's devices.
Native credential manager app coverage across all 4 major operating systems (Android, iOS, macOS, Windows) and browser extension support for the others.
- Excellent: Native apps for all 4 major OSs, plus browser extensions for others.
- Partial: Missing one key platform, or meaningful browser limitations.
- Limited: Primarily locked to one ecosystem.
Works easily with websites & appsNative Platform IntegrationCore
Does signing in actually feel seamless, or do you have to fight with a browser extension? A top score means passkeys just work by integrating directly into your operating system. A low score means you're stuck with manual workarounds and hacks.
Depth of native platform API support (e.g., system-level credential manager integration) versus reliance on browser extensions or other manual workflows.
- Excellent: Full native platform integration across major platforms; seamless passkey use in browsers and native apps.
- Partial: Native platform integration on some platforms, but meaningful reliance on browser extension workflows.
- Limited: Little or no native platform integration.
Keeps your credentials secureE2EE Vault SecurityCore
Even the company that makes this app shouldn't be able to read your saved passwords and passkeys. A top score means your vault uses end-to-end encryption strong enough that only you hold the key. A low score means it falls short of that bar.
Whether the vault meets a zero-knowledge/end-to-end encryption bar, including strong modern cryptography and encryption of sensitive metadata, not just secret values.
- Excellent: Meets the highest E2EE/zero-knowledge protection bar, including strong modern cryptography and encrypted sensitive metadata.
- Partial: Strong E2EE/zero-knowledge protection, but doesn't meet all top-tier requirements.
- Limited: Does not meet the expected E2EE/zero-knowledge protection bar.
Lets you leaveCredential ExchangeCore
If you ever want to switch to a different credential manager app, can you actually take your passkeys with you? A top score means you can directly move your passkeys, passwords, and other vault data out. A low score means your passwords might export, but your passkeys are stuck.
Support for direct, standards-based transfer of both passwords and passkeys (e.g., via the FIDO Credential Exchange Protocol), versus partial support or passkeys that can't be exported at all.
- Excellent: Direct, standards-based transfer of passwords and passkeys.
- Partial: Partial or limited standards-based credential transfer.
- Limited: Passwords may export, but passkeys are effectively trapped.
Built for the future of sign-inInteroperabilityCore
Passkey technology keeps improving. A top score means this credential manager keeps up with the newest capabilities, not just the basics from a few years ago. A low score means it only supports the fundamentals.
The implementation adheres to the WebAuthn L3 specification, ensuring interoperability and consistency across the ecosystem.
- Excellent: Demonstrated support and adherence to the WebAuthn L3 specification.
- Partial: Strong passkey support, but lacks full WebAuthn L3 support and adherence.
- Limited: Basic passkey support only, or no WebAuthn L3 support and adherence.
Protects your digital legacyDigital InheritanceLower weight
If something happens to you, can a trusted person get into your accounts? A top score means there's a real, built-in way to grant emergency or legacy access. A low score means there's no practical way for even loved ones to get in.
Whether there's a purpose-built emergency/legacy access mechanism for passkeys, passwords, and other vault data, versus manual recovery planning or no practical trusted-access mechanism.
- Excellent: Purpose-built emergency/legacy access to passkeys, passwords, and other vault data.
- Partial: Access possible with meaningful limitations or manual recovery planning.
- Limited: No practical trusted-access mechanism for passwords and passkeys.
Shares with friends & familyFamily SharingLower weight
Sometimes you need to share a login with a partner or family member. A top score means you can securely share both passwords and passkeys with people you trust. A low score means passkey sharing isn't possible at all.
Whether secure sharing extends to passkeys, not just passwords, and how limited that sharing is.
- Excellent: Secure sharing of passwords and passkeys.
- Partial: Passkey sharing exists but with meaningful limitations.
- Limited: No passkey sharing.
Technical detail
Synced vs. device-bound passkeys
Most devices include a credential manager which creates synced passkeys, where the private key is encrypted and synced across your devices. The sync is end-to-end encrypted; the credential manager vendor cannot decrypt or use the private key. Device-bound passkeys exist only on one device. They're more secure against cloud or service compromise but less convenient: if you lose the device, you lose the passkey. They are not available by default and require additional software, such as a specific credential manager or a piece of hardware. Security keys and Windows Hello are examples of authenticators which create device-bound passkeys.
Start using passkeys
Start saying goodbye to passwords, one sign-in at a time
You said hello to passkeys. Now it's time to start saying goodbye to passwords. Look for the passkey icon on the sites and apps you use.
EXAMPLES OF PASSKEY EXPERIENCES
Button to create a passkey
Button to sign in with a passkey
Autofill on desktop
Keyboard suggestion on mobile
It only takes a few seconds to get started. After that, you can spend less time signing in and more time getting on with your day.
Passkeys at work
What's different about using passkeys at work?
Passkeys typically work the same way at your job as they do everywhere else, but the environment around them often doesn't. A single compromised work account can put an entire company at risk, so employers frequently layer on stricter rules than you're used to at home.
You may not get to choose your credential manager
At home, you pick whatever app or device feels right. At work, IT and security teams often decide for you by requiring you to use a specific credential manager, a managed device, or a physical security key so that every employee meets the same security bar.
Extra steps may be required
Some organizations add a PIN, a biometric check, or a managed-device requirement before a passkey can be used, especially for sensitive systems like finance, HR, or admin consoles.
The sign-in screen might look different
You might be prompted to insert a security key, see your company's own branding, or find that your personal device's built-in passkey option isn't offered at all.
Two different worlds
Personal life vs. work
Your personal accounts
You're in control
Your work accounts
IT sets the rules
What you might encounter at work
Technical detail
Enterprise controls behind the scenes
Organizations with specific security requirements, such as requiring hardware-backed, attested device-bound passkeys, need to provide an authenticator and/or credential manager to their users which meet these requirements. This could be one or more hardware security keys or a specific work-centric credential manager app, both of which can have specific behavior applied based on policies.
It's similar to file storage or AI tools: if you don't want employees choosing their own, you provide (and require) an approved option that meets your policies. This is why managed credential managers that support device-bound passkeys are appealing: they let you enforce your security requirements without full device management (MDM), because the enforcement happens at the credential manager level rather than the OS level.
No matching questions found. Try a different search term.
Basics
What is a passkey, exactly?
A passkey is a unique digital key that replaces your password. When you create one, two linked digital keys are created: one is securely stored in your credential manager, and one is shared with the website or app. When you sign in, your device verifies it’s you using your face, fingerprint, or device PIN, then uses your part of the passkey to securely prove it’s you. Your private key is never shared with the website.
How is a passkey different from a password?
A password is a secret that you know and type into a website. A passkey is a unique digital key stored in your credential manager that you don’t need to remember or type. Every passkey is unique to the website or app it was created for, so it can’t be guessed, phished, or reused across other accounts like a password can.
How is a passkey different from 2FA (like text codes or authenticator apps)?
Traditional two-factor authentication, or 2FA, usually adds another step after you enter your password, such as a code sent by text or generated by an app. A passkey can replace both the password and these additional steps by securely verifying that you have your passkey and that it’s really you using your face, fingerprint, or device PIN. Some websites may still require additional verification depending on how they have implemented passkeys.
What is FIDO2, and how does it relate to passkeys?
FIDO2 is the technical standard passkeys are built on. You don't need to know the details - just know that "passkey" is the friendly name for what FIDO2 makes possible, and it's why passkeys work the same way across operating systems, websites, apps, devices and credential managers from different companies.
Is a passkey the same as a physical security key (like a YubiKey)?
A physical security key can store a passkey, but you don’t need one to use passkeys. Most consumers store their passkeys in a credential manager on their phone, computer or other devices. Physical security keys are another option for storing your passkeys and can be useful for people who want an additional way to sign in.
Does using a passkey mean I'm sending my fingerprint or face scan to the website?
No. Your fingerprint or face scan is used by your device to verify that it’s you. Your biometric information never leaves your device and is never shared with the website or app.
What do I need to actually log in with a passkey?
You need access to your passkey through your credential manager and a way to verify it’s you, such as your face, fingerprint or device PIN. In most cases, you don’t need to download anything new because your phone or computer already has a credential manager built in.
What's the difference between my device PIN and my old password?
A password is shared with a website when you sign in. Your device PIN is used locally to verify it’s you and isn’t shared with the website. When you use a passkey, your device PIN can be one of the ways your device verifies that you’re authorized to use your passkey. Your device PIN/passcode is never shared with the website or app.
Where are passkeys actually stored?
Usually in one of two places: your device's built-in secure storage (a protected chip separate from the rest of the phone/computer) or your credential manager, if you use one. You generally can't "see" the raw key, similar to how you can't see the code behind a stored password - but you can see and manage the list of passkeys you've created in your account settings or credential manager.
Do Google, Apple, or Microsoft own my passkeys, and can they block me?
No, passkeys belong to you and are tied to the website, not to Google/Apple/Microsoft. Those companies offer a place to store and sync them (similar to how they offer a place to store and sync your photos). But keep in mind, if you lose access to that account, you may not be able to access them on a new device. If you're not comfortable with that, you can store passkeys in a different credential manager instead.
Setting Up and Everyday Use
How do I set up a passkey?
When a website or app offers passkeys, look for an option like “Create a passkey” or “Set up a passkey” in your account or security settings. Your device will ask you to verify it’s you using your face, fingerprint or device PIN. Your passkey will then be created and stored in your credential manager. Some websites and apps will ask you to set one up after signing in.
Why does a site ask me to create a passkey when I already have a password?
Many websites and apps are adding passkeys as a safer and easier way to sign in. Creating a passkey lets you use it instead of typing your password the next time you sign in. Depending on the website, your password may remain as another sign-in or recovery option.
Why did I set up a passkey but the site still asked for a password?
This usually happens when you're on a new device or browser that hasn't been "introduced" to your passkey yet. Once it's set up on that device too, the prompt should stop. It's an inconsistency in how some sites are still rolling this out, not something wrong with your passkey.
Why do some sites still ask for a second code even after I use a passkey?
A few sites haven't fully updated their systems yet, so they still ask for old-style 2FA out of caution. It's redundant, but harmless - it should go away over time as sites finish their rollout.
Can I use only a passkey, with no password at all?
This is how passkeys are designed to be used, but some sites still require you to set up a password, even if you plan to always sign in with your passkey, as a way to have a “just in case” backup account recovery method.
Why does using a passkey feel like more steps than a password?
Right now, some websites still show extra prompts (like "do you want to use a passkey?") while they're getting people used to the new option. As it becomes standard, it will be super quick: verify it’s you with your face, fingerprint or device PIN and you’re in.
Can I name my passkeys so I can tell them apart?
Yes, many websites and apps let you label each passkey. This makes it easier to know which one to remove if you lose a device. But keep in mind that most passkeys will be available across all of your devices, so naming them by device can be confusing. Many sites will automatically name the credential manager where you saved them (e.g. Google Password Manager, Apple Passwords, Bitwarden). If a name is not auto populated, consider using your credential manager’s name instead of the device.
How do I turn off the "save a passkey?" pop-ups if I don't want them?
These prompts may come from a website, browser or credential manager, so how you turn them off depends on where the prompt is coming from. Check the passkey, sign-in or autofill settings in your browser or credential manager.
Multiple Devices and Syncing
How do passkeys work if I use a phone, laptop, and other devices (like a game console)?
It depends on where your passkey is stored. Many credential managers can securely sync your passkeys across your devices, so a passkey you create on your phone may also be available on your laptop or tablet. Some passkeys are stored only on a specific device and don't sync. If your passkey isn't available on the device you're using, you may still be able to use a passkey from another device, such as your phone, to sign in.
Can I sync passkeys between my phone and my computer?
Yes, if your credential manager supports both devices and passkey syncing. Otherwise, each device's passkeys stay separate.
Can I move a passkey from one credential manager to another?
Support for moving passkeys between credential managers is improving, but it isn't available everywhere yet. Whether you can move your passkeys depends on the credential managers you are moving between and the features they currently support; our credential manager scoring guide lists what managers currently support this. Look for the “Credential Exchange” feature.
Why does syncing sometimes ask me for an unrelated PIN, like my phone's PIN, on my laptop?
This happens when your laptop and phone are linked for passkey syncing, and the system is double-checking it's really you by confirming through both devices. It can look confusing but is functioning as intended.
How do I use a passkey on a device I don't own, like a library or friend's computer?
You may be able to use a passkey from your phone or tablet to sign in on another device without storing your passkey on that device. Look for an option like “Use another device” when signing in. You’ll likely be shown a QR code that you can scan with your phone to continue the sign-in.
Can I use passkeys across different operating systems, like macOS and Windows?
Yes, but the experience isn't always seamless. Passkeys stored in one platform's credential manager don't necessarily sync directly to another platform. For example, if your passkey is stored with Apple Passwords and you're signing in on a Windows computer, you may need to use your iPhone to sign in, such as by scanning a QR code. If you regularly use devices and browsers from different ecosystems, choosing a credential manager that works well across all of them can make using passkeys much easier. See our credential manager scores to compare which options offer the best support across devices, operating systems and browsers. And if you need to move existing passkeys to another credential manager, make sure your next credential manager scores high in the Credential Exchange Support category.
Backup, Loss, and Recovery
How do I back up my passkeys?
If your passkeys are synced by your credential manager, they can be available again when you sign in to your credential manager on a new device. If a passkey was stored only on the device you lost, you'll need another way to sign in or recover your account. This is why using a credential manager is really helpful to ensure you can always get into your accounts.
What happens if I lose my phone or my computer breaks?
Being able to recover your passkeys depends on your credential manager and how you have it set up. Credential managers have different approaches to account recovery, backup and access from a new device, so it's important to understand your recovery options before you need them. See our credential manager scores to compare how different options handle security, recovery and digital legacy. If you can't recover your passkeys, you may need to use the account recovery process provided by each website or app.
Can I switch phone carriers or lose my phone number without losing my passkeys?
Yes. Passkeys aren't tied to your phone number - they're tied to your credential manager account or device, so changing carriers shouldn't affect them. Just make sure your new device has access to your credential manager before trading in your current one.
Can I export and back up my passkeys myself, without relying on a big company?
Some credential managers support this now, others don't yet. If full control over your backups matters to you, check your credential manager's specific export options.
Managing Multiple Passkeys
Should I set up more than one passkey per account?
It depends on how your passkeys are stored. If your credential manager syncs your passkeys across your devices, you generally don’t need multiple passkeys per account. If your passkey is stored only on one device, or you want another way to access your account, it is a good idea to create additional passkeys.
Can I limit an account to only one device's passkey?
Some sites offer this as a security option in account settings, though it's not universal. Check the specific site's security settings.
Should I use a passkey as my only login method, or keep a password as backup too?
Use a passkey whenever a website or app gives you the option. Whether you can remove your password entirely depends on the website. Some support passkey-only accounts, while others keep your password as another sign-in or recovery method. If you can remove your password, make sure you have another reliable way to access or recover your account if you lose access to your passkey.
Security
Are passkeys more secure than passwords and old-style 2FA?
Yes. Passkeys are designed to protect against phishing and other common attacks that can steal passwords and verification codes. Every passkey is unique to the website or app it was created for, so it can't be guessed, reused on another site or tricked into working on a fake website.
If someone steals my phone, can they get into my accounts?
Someone would only be able to use your passkeys if they can also unlock your device (fingerprint, face, or PIN), since that's required to use any passkey stored there. This is generally harder for a remote attacker than stealing a password.
Can a website tell the difference between a passkey in a credential manager and a passkey on a physical security key?
Yes, technically it can, though for most everyday logins it doesn't matter - both are treated as equally trustworthy.
Is there a security risk if my credential manager or account provider is hacked?
Yes, but the risk is different from a password breach. Passkeys aren't reusable secrets like passwords, so an attacker can't simply steal a passkey and use it to sign in to your account. Your passkeys are also protected by the security of your credential manager and the devices you use to access it. This is why choosing a secure credential manager matters. See our credential manager scores to compare how different options protect your passkeys and account.
What cryptographic algorithms do passkeys use?Advanced
Passkeys use public-key cryptography, most commonly ECDSA with the P-256 curve (COSE algorithm -7) as defined in the WebAuthn spec. Some authenticators also support RS256 (RSASSA-PKCS1-v1_5) or EdDSA. During registration, the authenticator generates a key pair and returns the public key and a credential ID to the relying party. During authentication, the authenticator signs a server-generated challenge with the private key, which the server verifies against the stored public key.
Sharing and Family Access
Can I share a passkey-protected account with a family member?
Sometimes. Some credential managers let you securely share passkeys with family members or other trusted people. Whether you can share a passkey depends on the credential manager you use and whether the website or app allows the passkey to be shared. See our credential manager scores to compare which options support family sharing.
How do I make sure my family can access my accounts if something happens to me?
This depends on your credential manager. Some offer features such as emergency access, legacy contacts or other digital inheritance features that can help trusted people access your accounts or credentials if something happens to you. If this is important to you, set it up in advance. See our credential manager scores to compare how different options support your digital legacy.
If my platform account gets suspended, can I still log in elsewhere with a passkey stored there?
Not necessarily. If you lose access to the account that your credential manager depends on, you may also lose access to passkeys stored or synced through that credential manager. What happens depends on the provider and the recovery options you have set up. This is one reason it's important to understand how your credential manager handles account recovery and access. See our credential manager scores to compare your options.
Switching Credential Managers and Vendor Lock-In
Am I locked into one credential manager once I start using passkeys?
Not by design. In practice, though, credential managers are still catching up to support passkey migration, but most popular credential managers do now support secure credential migration, including passkeys, to another service. Support for Credential Exchange is actively expanding throughout the ecosystem. See the "Let's you leave" category in the credential manager scores section.
Why can't I freely move my passkeys between devices or credential managers I own?
The underlying technology supports this, but not every company has built the tools to make it easy yet. It's a feature gap and not a fundamental limitation of passkeys.
Trust and Adoption
Why do so many sites explain passkeys so poorly?
This is a fair criticism. Since passkeys are still new to most people, many websites haven't invested in clear explanations yet. It's a known gap in the industry that most sites struggle with. That’s one of the reasons this website exists!
Why should I bother if something better might replace passkeys next year?
Passkeys are built on an open industry standard (FIDO2) supported by Apple, Google, and Microsoft together, so they're expected to be the long-term direction rather than a temporary fad. Setting them up now still reduces your risk today.
Are passkeys going to work the same way for years, or will I have to relearn this again?
The core idea (unlock your device to log into a website) is expected to stay consistent. What's still improving is the syncing and credential manager migration experiences described above.