What passkeys are, in plain terms
Passwords ask you to remember a secret, type it into a box, and hope no one else has seen it. Passkeys change that deal. A passkey lets you sign in by confirming on your own phone or computer, with a fingerprint, a face scan, or a PIN, instead of typing a password that can be copied, guessed, or tricked out of you.
**Key takeaways**
- A passkey is a sign-in credential tied to one site or app, not a typed secret you share with the site.
- Your device proves it holds the passkey. Your fingerprint or face data stays on the device and is not sent to the site.
- Generative AI can now build fake login pages that look very close to real ones, which makes a sign-in with nothing to type more useful.
- Passkeys do not yet work everywhere, and you still need a recovery plan if you lose a device.
A password is a shared secret. You know it, and the site checks it. That sharing is the weak point. If the secret leaks in a breach, if you reuse it on another site, or if you type it into a page that only looks like the real site, it can be used against you.
The FIDO Alliance describes a passkey as a credential based on FIDO standards, which can live on your phone or computer, or on a hardware security key. It is tied to your account on one website or app. When you sign in, you approve the sign-in in the same way you open your device: with a fingerprint, a face scan, a PIN, or a pattern.
Two keys, not one secret
Behind the simple tap sits a pair of linked keys. The technical name for this method is public-key cryptography. Your device creates the pair when you set up the passkey. One key is public, and the site stores that one. The other key is private, and it stays with you, on your device or in your credential manager.
That split matters. The public key on its own cannot sign you in, so a stolen site database gives an attacker public keys, not the private keys needed to pass the check. A passkey is also tied to the site it was made for, so it cannot be used on a lookalike site.
FIDO draws a line between synced and device-bound passkeys. Synced passkeys move between your devices through your passkey provider, with syncing that FIDO states is end-to-end encrypted. Device-bound passkeys stay on one device, so losing that device has a sharper cost. Know which kind you have before you rely on it.
How a passkey sign-in works
A passkey sign-in has three short steps. First, you go to the site or app and choose to sign in. Second, your device asks you to confirm, in the same way you open the device. Third, your device proves it holds the private key, and the site checks that proof against the public key it already holds. No typed password travels between you and the site.
For a Google Account, Google Support lists fingerprint, face scan, and phone screen lock, such as a PIN, as the ways to confirm. Google also states that passkeys cannot be shared, copied, written down, or accidentally given to someone else, which makes them harder to hand over in a phishing attack than a password.
Signing in on a different device
You do not always sign in on the device that holds the passkey. Google describes a common case: you sign in on a computer with a passkey held on your phone, by scanning a QR code on the computer screen with your phone and confirming on the phone. Bluetooth needs to be on for this step, and on Apple devices, iCloud Keychain needs to be on for passkeys to sync.
What the site sees, and what it does not see
This point is often misunderstood. The site does not receive your fingerprint or your face image. FIDO states that biometric information and its processing stay on the device, and the server only receives confirmation that the on-device check passed. Google gives the same account for its service: biometric data stays on the device and is never shared with Google.
That distinction matters. A site cannot leak a fingerprint it never received, though it can still record that you signed in, and when. A passkey changes how you prove who you are, not the rest of your account activity.
How AI makes fake login pages harder to spot
Fake login pages are not new. What has changed is how easy they are to build and how close they look to real pages. A report in The Hacker News on 27 October 2026, written as a contributed piece by Aranza Trevino at Keeper Security, states that generative AI makes it easier to recreate familiar login screens, copy brand styling, and tailor a phishing message to a specific person or workplace. Some fake pages also copy multi-step sign-in screens to collect one-time codes, or pass your sign-in through in real time to capture a session token.
That last trick is called Adversary-in-the-Middle, or AiTM. A fake site relays your sign-in to the real service, so you may even reach the real service while the attacker keeps a session token that lets them return without another sign-in check. The Hacker News piece also warns that filters and reputation lists can miss newly registered, short-lived fake sites, and that a valid HTTPS padlock only shows the connection is encrypted, not that the site is the one you meant to visit.
Why a typed secret fails first
A password, and even a one-time code typed by hand, can be handed to a fake page before you notice the address was wrong by one letter. A passkey breaks that chain, because there is nothing to type. Browser checks for lookalike domains can add a second layer, but they still depend on spotting a fake page.
AI on both sides of the same fight
It would be wrong to present AI as only a defence. The same kind of AI that helps a browser flag a suspicious page also helps an attacker write a fluent, personal message and build a convincing copy of a login screen at speed. In a 2024 survey commissioned by the FIDO Alliance, 53% of people said they had enabled passkeys on at least one account, while only 22% said they had enabled them on every account they possibly could. Adoption is growing, but uneven.
Where passkeys do not yet help
Passkeys are not a fix for every account problem. The first limit is simple: not every site or app supports them. If a site offers only a password, a passkey cannot help you on that site until the site adds support. You will still need passwords, and good password habits, for those accounts.
The second limit is recovery. A passkey is only as useful as your plan for losing the device that holds it. A synced passkey should return on a new device with the same passkey provider, according to FIDO. A device-bound passkey on a single hardware key is lost with that key, unless you set up a second key or another recovery method in advance.
The third limit is account takeover that does not need a sign-in at all. A passkey protects the sign-in step. It does not stop an attacker who already holds a live session token, or fix a weak recovery email, a shared device, or a support process that can be talked into resetting an account. No single sign-in method covers every route in.
Treat strong vendor numbers about passkeys with care. Check instead: does the site support passkeys, does your device support them, and can you still get in if you lose your phone?
Set up passkeys without locking yourself out
Start with one low-risk account, not your main email. Pick one where you already have a recovery email and phone number set. Add the passkey, sign out, and sign back in with it. Only then add passkeys to more important accounts.
Your operating system and browser need to be up to date. For Google Accounts, supported devices at the time of writing include computers running at least Windows 10, macOS Ventura, or ChromeOS 109, and phones running at least Android 9 or iOS 16. Supported browsers include Chrome 109 or up, Safari 16 or up, Edge 109 or up, and Firefox 122 or up. Check the current Google Support page before you start, as those numbers will change.
Only on a device you own
Google warns that you should only create passkeys on devices you personally own and use. Once you create a passkey, anyone who can open that device can use it to reach the account. Do not create one on a shared computer, a borrowed phone, or a work device others can open.
Google also warns that a newly created passkey may take 7 days to become available at sign-in. If you already hold a trusted passkey or a physical security key, Google says you may be able to shorten that wait. Do not plan a passkey switch on the same day you need urgent access to an account. Give yourself a week of overlap, with your old sign-in method still working.
A recovery checklist you can copy
Use this checklist before you rely on passkeys for an important account. First, note whether each passkey is synced or device-bound. Second, add a second sign-in method you control, such as a second device or a hardware key. Third, check you can still reach your recovery email and phone number. Fourth, if you lose a device, remove its passkeys from your account settings at once. Fifth, test the recovery path once, on purpose, while calm. If a service gives no clear recovery path, keep your existing sign-in method until it does.
Frequently asked questions
Do passkeys replace my password everywhere?
No. Passkeys replace passwords only on sites and apps that support them. For other accounts, you still need a password, and you should keep those passwords distinct.
Will a site get my fingerprint or face scan?
No. The fingerprint or face check happens on your device. FIDO states that biometric information stays on the device and is never sent to a remote server, and Google states the same for its service. The site receives proof that the on-device check passed, not the biometric data itself.
What happens if I lose my phone?
It depends on the kind of passkey. A synced passkey should return when you set up a new device with the same passkey provider, according to FIDO. A device-bound passkey on a lost hardware key will not return on its own, so you need a second key or another recovery method in advance. Remove passkeys from the lost device in your account settings at once.
Pick one account, check that it supports passkeys, and set up a passkey on a device you own, while keeping your current sign-in method until you have tested sign-in and recovery.
If you would like help setting up a low-risk sign-in plan for your business, explore our services or contact us for a free consultation.
What to watch next
Update this article if a major service used by small businesses adds or removes passkey support, if Google changes its 7-day wait for new passkeys, or if FIDO publishes new adoption figures. At the time of writing, the facts above were checked on 2026-10-31.
Sources
- FIDO Alliance — FIDO Passkeys: Passwordless Authentication — date checked: 2026-10-31 — https://fidoalliance.org/passkeys/
- Google — Sign in with a passkey instead of a password (Google Support) — date checked: 2026-10-31 — https://support.google.com/accounts/answer/13548313
- The Hacker News — AI-Generated Fake Login Pages Are Making Account Takeovers Easier — date checked: 2026-10-31 — https://thehackernews.com/2026/10/ai-generated-fake-login-pages-are.html
