What is a passkey, exactly?
A passkey is a cryptographic key pair two pieces of data that are mathematically linked. When you create a passkey for a website, your device generates a private key (stored only on your device, never sent anywhere) and a public key (sent to the website). When you log in, the site sends a challenge, your device signs it with the private key, and the site verifies the signature with the public key.
There is no password involved. The site never sees anything that could be stolen. Even if the company gets breached, the attacker gets a public key which is completely useless without the private key sitting on your phone.
Phishing attacks work by tricking you into entering your password on a fake site. Passkeys are bound to the exact domain they were created for. A fake Google login page simply cannot trigger a Google passkey your device refuses. Phishing is structurally impossible, not just harder.
Passkeys vs passwords vs password managers
| Feature | Password (no manager) | Password Manager | Passkey |
|---|---|---|---|
| Phishing resistant | ✗ No | ~ Partial | ✓ Yes |
| Works if site is breached | ✗ Exposed | ~ Hashed only | ✓ Safe |
| No password to remember | ✗ No | ✓ Yes | ✓ Yes |
| Works across devices | ✓ Yes | ✓ Yes | ~ Getting better |
| No 2FA needed | ✗ Still need it | ✗ Still need it | ✓ Built in |
| Recovery if device lost | ✓ Easy | ✓ Easy | ~ Improving |
The honest summary: passkeys are more secure than passwords in every meaningful way. The only real weakness right now is cross-device recovery but Apple, Google, and 1Password have all shipped syncing solutions that make this much less painful than it was in 2024.
Where can I use passkeys today?
As of April 2026, passkeys are supported on all the accounts that matter most.
Google, Apple ID, Microsoft, GitHub, Shopify, PayPal, Amazon, Coinbase, X, WhatsApp, Dashlane, 1Password, Robinhood, Adobe, Dropbox, LinkedIn, TikTok, Discord, Uber, Airbnb, Nintendo and over 900 other services. Check passkeys.directory for the full live list.
How to set one up
What passkeys do not fix
Passkeys protect your login credentials. They do not protect data that was already stolen. If your email, phone number, or home address was exposed in a breach last year, that data is already out there. Passkeys will not pull it back. This is why monitoring your breach exposure is still essential even after switching to passkeys.
Passkeys also do not help if your device is compromised by malware that can intercept biometric approval. Keep your devices updated and avoid sideloading apps from unofficial sources.
They also do not help if you lose access to all your synced devices simultaneously. Always set up an account recovery contact or keep a physical hardware key like a YubiKey as a backup.
And they do not help if the app you care about does not support them yet. Banking apps are notoriously slow to adopt. Keep using strong unique passwords and a password manager for those services.
Passkeys protect future logins. But your email and old passwords from past breaches are still floating around on the dark web. Check your exposure score free, no account required.
Sources
- FIDO Alliance Passkey Adoption Report 2025 — cross-platform passkey deployment statistics
- Google Security Blog 2025 — passkey adoption rates across Google accounts globally
- Apple Platform Security Guide 2025 — iCloud Keychain and passkey sync architecture
- Verizon Data Breach Investigations Report 2024 — credential theft as the primary breach entry point
- passkeys.directory — live directory of services supporting passkey authentication as of 2026