A passkey is a modern, passwordless way to sign in to apps and websites that replaces traditional passwords with a more secure and convenient system. Instead of typing a password, you use your device—like a smartphone, computer, or password manager—to prove your identity, typically by unlocking it with biometrics (such as Face ID or fingerprint), a PIN, or your device password.
How passkeys work:
- When you register for a site or app that supports passkeys, your device generates a unique pair of cryptographic keys: a public key (stored on the website’s server) and a private key (kept securely on your device).
- The public key is not secret and is useless on its own. The private key never leaves your device and is used to prove your identity when you log in.
- During sign-in, the website sends a challenge to your device. Your device uses the private key to sign this challenge, and the website verifies the response using the public key. If it matches, you’re granted access—all without ever sending your private key or biometric data over the internet.
Benefits of passkeys:
- More secure: Passkeys are resistant to phishing, credential theft, and data breaches because there’s no password to steal or reuse, and the private key never leaves your device.
- Convenient: You don’t have to remember or type passwords, and sign-in is often as simple as unlocking your device.
- Cross-device: Passkeys can sync across your devices (like through iCloud Keychain or a password manager), making them easy to use wherever you need them.