Updated 12/31/25 – clarified platform and browser support:
If you’re tired of remembering complex passwords or worrying about phishing attacks, passkeys offer a simpler, safer alternative. Major platforms like Google, Microsoft, Apple and Yahoo now support passkeys, and they’re designed to replace passwords entirely. In this guide, we’ll explain what passkeys are, how to set them up, and how you can use them across multiple devices—even for the same account.
A passkey is a modern, more secure alternative to traditional passwords. Instead of remembering a string of characters, you use the same methods you already use to unlock your devices to sign in to websites and apps — such as your fingerprint, facial recognition, or screen lock PIN/password.
How It Works
Passkeys are built on the WebAuthn standard and use public-key cryptography. When you create a passkey, your device generates a unique pair of cryptographic “keys”:
- The Public Key: Shared with the website or app you’re using.
- The Private Key: Stored securely on your device (and never shared).
When you sign in, the website sends a digital “challenge” to your device. Your device uses the private key to sign the challenge and sends it back. Since the website has the matching public key, it can verify your identity without ever seeing your actual biometrics or a password.
Why Passkeys Are Better
- Phishing Resistant: Since there is no password to type or steal, hackers can’t trick you into giving it away on a fake website.
- Less Worry About Data Breaches: If a company’s passkey database is hacked, they only have your public keys, which are useless to attackers without your physical device.
- Simplicity vs Passwords: You only have to know your account username – which is typically your email address. During account creation you don’t have to abide by complex password rules (like “must be unique and include a symbol and a number”), nor write down or manually save the passkey for the account.
Where Are They Stored?
Most passkeys are stored on your device and synced through your cloud account (like Microsoft Password Manager, Apple/iCloud Keychain, Google Password Manager, or passkey managers such as LastPass or Bitwarden). This means if you get a new computer or device, your passkeys move with you automatically with your cloud account, so you aren’t locked out of your accounts. They are then available for signing into your accounts via supported web browsers and apps. See chart below for specifics.
What websites support Passkeys?
Major email providers Google, Microsoft and Yahoo now support passkeys. Many major retailers such as amazon.com, besybuy.com and costco.com also support passkeys. However, banks and brokerages – likely where most of your money is kept – have been slow to adopt passkeys. Here’s a non-comprehensive list of websites that support passkeys: passkeys.directory