Short answer
A passkey replaces your password with a key pair: the public key is stored by the website or app, the private key stays on your device and is unlocked with your face, fingerprint or PIN. Because there is nothing to type or share, passkeys are resistant to phishing. Google, Apple, Microsoft and Facebook all support them. Create passkeys only on devices you own, never on a shared one, and keep your recovery email, phone and codes up to date — a passkey doesn’t replace account recovery.
How a passkey works
- Your device creates a private key (kept on the device) and a public key (registered with the site).
- To sign in, you unlock the private key with face, fingerprint or PIN; the device proves it’s you without sending a password.
- Google says your biometric data stays on your device and is never shared with it.
Set it up
- Google: myaccount.google.com/signinoptions/passkeys → Create a passkey. Adding one doesn’t remove your other sign-in or recovery methods.
- Apple: needs iCloud Keychain and two-factor authentication; passkeys sync across devices signed in to the same Apple Account.
- Microsoft: add a passkey to your Microsoft account; works on Windows 10+, macOS Ventura+, iOS 16+ and Android 9+.
- Facebook: Accounts Center (becoming Meta Account) → Password and security; with Meta Account, passkeys also work on Instagram. WhatsApp passkeys are managed inside WhatsApp.
Rules that keep you safe
- Create passkeys only on devices you own and protect with a screen lock — anyone who can unlock the device can use them.
- Don’t create them on shared or public devices.
- Keep a recovery email, phone number and backup codes current, so losing a phone doesn’t lock you out.
Signing in on someone else’s computer
Choose the passkey option on the sign-in page and scan the QR code with your phone; the passkey stays on your phone. On Google, a passkey also counts as the second step of 2-Step Verification, because it proves you hold the device.
Already locked out?
A passkey prevents takeovers; it doesn’t recover an account that is already lost. Start with official recovery links, lost 2FA or Apple Account locked. Our hacked account recovery service works through official channels.
Frequently asked questions
Is a passkey safer than a password?
Yes: it can’t be phished, reused or leaked in a data breach the way a password can, because the private key never leaves your device.
What happens if I lose my phone with my passkeys?
Synced passkeys (Apple, Google) are available on your other devices; otherwise use your recovery methods. Keep recovery email, phone and codes current.
Can I still use my password?
Usually yes. Google, for example, keeps your password unless you choose otherwise.
Does WhatsApp use the same passkey as Facebook?
No. Meta says WhatsApp passkeys are managed within WhatsApp separately.
Sources: Google Account Help — sign in with a passkey, Apple Support — about the security of passkeys, Microsoft Support — what are passkeys, Facebook Help — create a passkey on Facebook, Meta Newsroom — Meta Account