What Is a Passkey, and Is It Better Than a Password?

A passkey is a sign-in credential designed to replace a traditional password. Instead of typing a shared secret that a fake website can steal, your device or credential provider uses cryptography to prove that you have the correct credential for the real service.

What happens when you create a passkey

Passkeys are based on public-key cryptography. In simplified terms, the service keeps a public key while the corresponding private credential remains under the control of your device or passkey provider. The service does not need your reusable password in order to authenticate that passkey.

You commonly unlock use of a passkey with the same local method you use to unlock a device, such as a PIN or biometric check. That local unlock is not sent to the website as your password.

Why passkeys help against phishing

Traditional phishing works well because people can be tricked into typing a password into a convincing fake sign-in page. Properly implemented passkeys are bound to the website or app they were created for, so they are designed to resist that kind of credential phishing.

That does not make every account risk disappear. Someone who controls an unlocked device, compromises an account used to synchronize credentials, or manipulates account recovery may still create problems. Passkeys improve the sign-in mechanism; they do not eliminate the need to protect your devices and recovery options.

Where passkeys are stored

The exact answer depends on the platform and service. Major operating-system and credential providers can store or synchronize passkeys so they are available across your authorized devices. Some services also let you use a passkey from another nearby device.

Before deleting an old password or changing recovery settings, check how that particular account handles passkey synchronization, additional sign-in methods, and account recovery.

Do you need to switch immediately?

No. Use passkeys where reputable services support them and where you understand the recovery setup. For accounts that still require passwords, continue using a unique password for each account and protect important accounts with strong multi-factor authentication.

A password manager remains useful even in a world with passkeys because many websites still use passwords, and credential managers can help organize both types of sign-in.

The practical takeaway

Passkeys are not simply shorter passwords. They change the underlying authentication method so there is no reusable password for you to type into a phishing page. That is a meaningful security improvement, provided you also protect the devices and accounts that hold or synchronize your credentials.

Sources and Further Reading

Google Account Help — Sign in with a passkey instead of a password FIDO Alliance — Passkeys overview NIST — Digital identity guidance