CyberThreats.au

Independent cybersecurity education

SearchScammed or hacked?Get help

For you

ScamsIs this a scam?

Types of scams

All scam guides

Practise

Protect yourselfMake my security checklist

Your devices

Everyday situations

Accounts and passwords

Privacy

All protect yourself guides
Cyber threats

Common threats

Newer and specialised threats

All cyber threat guides
Security products

Devices

Accounts and identity

Network and privacy

Backup

All product guides
Free checklists

For you

For work

All free checklists

For work

Small businessSmall business security checklist

Foundations

Payments, suppliers and incidents

All business guides

AI and cloud

All AI and cloud guides
Microsoft 365Microsoft 365 readiness checklist

Identity and access

Email

Teams, SharePoint and OneDrive

Data, devices and admin

All Microsoft 365 guides

Accounts and passwords

Passkeys explained: what they are and how they work

What are passkeys? How they work, why they resist phishing, synced versus device-bound passkeys, and how to create one for Google, Microsoft and Apple.

Last reviewed
Reading time
9 minutes

The basics for setting up passkeys, from official guidance

These are the steps the ACSC's passkeys guidance and Google's, Microsoft's and Apple's instructions describe. Passkeys are created from inside the real account settings, not from a link in a message.

  1. Check the device has a screen lockA passkey is unlocked the same way as the device. Google's first step is to turn on the phone's screen lock, and says anyone who can unlock the device can access the account.Google's passkey steps
  2. Create a passkey for an important accountGoogle: myaccount.google.com/signinoptions/passkeys. Microsoft: account.live.com/proofs/manage > Add a new way to sign in or verify. Other services: look in the account's security settings.Microsoft's passkey steps
  3. Keep passkeys off shared and work devicesThe ACSC says to avoid syncing passkeys to untrusted or shared devices, and to avoid storing passkeys for personal accounts on an employer-owned device.What the ACSC's guidance covers
  4. Have a backupSynced passkeys stay on other devices if one is lost. For security keys, the ACSC describes a backup passkey on a second FIDO2 key.Synced and device-bound passkeys
  5. Check whether the password can be switched offThe ACSC refers to disabling password sign-in once a passkey is set up. Not every service offers this; Google offers a Skip password when possible setting.Things to watch for
  6. Remove the passkey for a lost deviceFor Google: from another device, open Security & sign-in > Passkeys and security keys, select the lost device's passkey and select Remove.Full steps for removing a passkey

Based on the ACSC's passkeys page, the FIDO Alliance, and Google's, Microsoft's and Apple's passkey instructions, checked October 2026. Steps vary between services; each provider's page has the latest version.

Key points

  • A passkey can't be typed into a fake website, because there's nothing to type. The FIDO Alliance says phishing resistance is a core design goal of passkeys.
  • According to the ACSC, passkeys provide multi-factor authentication on their own.
  • Synced passkeys survive the loss of one device, but the ACSC says every device a passkey is synced to is another opportunity for theft.
  • Adding a passkey doesn't always remove the password from an account, so the password still needs looking after.

What are passkeys? A passkey is a way to sign in without typing a password: a secret stored on your phone, computer or a small security key, which you unlock the same way you unlock the device, with your face, fingerprint or PIN. Passwords have two well-known weaknesses: people reuse them, and people can be tricked into typing them into fake websites. Passkeys are designed to remove both problems.

This guide explains how passkeys work, the difference between “synced” and “device-bound” passkeys, and how to create one for the most common accounts.

Why it matters

Most account takeovers start with a stolen password. The password might come from a data breach on another website, or from a fake sign-in page sent in a text message. A passkey can’t be reused on another website, and it can’t be typed into a fake page, because there is nothing to type.

The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) describes passkeys as “a faster and more secure way to log in to your online accounts than using passwords”.

How a passkey works

A passkey is really a matched pair of digital keys:

  • A public key, which the website or app keeps. It’s no use to anyone on its own.
  • A private key, which stays on your device (or security key) and never leaves it.

When you sign in, the website sends a challenge that only the matching private key can answer. Your device asks you to confirm with your face, fingerprint or PIN, then answers the challenge. Apple’s platform documentation describes this as public-key cryptography, with a separate key pair for each account. The ACSC puts it simply: “One key is stored by the provider of your account, while the other is stored” on your device or on a FIDO2 security key.

Google’s passkey help page adds two useful points. Fingerprint or face data used to unlock a passkey “stays on your device and is never shared with Google”, and passkeys “can’t be shared, copied, written down, or accidentally given to someone else.”

Why passkeys resist phishing

A passkey is tied to the real website it was created for. If a scam text sends you to a look-alike site, your device won’t offer the passkey there, because the address doesn’t match. The FIDO Alliance, the industry group that develops the standard, says: “Phishing resistance is a core design goal of FIDO Authentication.” It also says “With passkeys there are no passwords to steal”.

Synced and device-bound passkeys

There are two main kinds.

Synced passkey Device-bound passkey
Where it lives Copied to your other devices, usually over the internet, and kept up to date (ACSC) On one device, or on a physical FIDO2 security key (ACSC)
Main benefit If you lose one device, the passkey is still on the others It never leaves the one device or key
What the sources say The FIDO Alliance says “Passkey syncing is end-to-end encrypted” The FIDO Alliance says “Device-bound passkeys in modern hardware security keys offer the highest security assurance.”
Risk the ACSC describes “Every device that you sync your passkey to, provides an opportunity for cybercriminals to steal your passkey.” The key can be lost, stolen or damaged, which is why the ACSC refers to a backup key

On Apple devices, Apple says passkeys are stored in the Passwords app and “sync across a user’s devices using iCloud Keychain”, which it describes as end-to-end encrypted. Google and Microsoft accounts can store passkeys in Google Password Manager, Microsoft’s password manager, other password managers, or on a security key.

What the ACSC’s guidance describes

The ACSC’s passkeys page covers these points:

  1. Where to store passkeys. It says to “avoid syncing your passkey to untrusted or shared devices”, to avoid “a device that you share with anyone else”, and to “avoid using an employer-owned device to store passkeys for your personal online accounts.”
  2. Security keys for important accounts. It describes buying “a FIDO2 security key from a reputable store to provide increased protection of your passkeys”, which it says is useful for your most important accounts.
  3. A backup key. It says: “It is recommended to create and store a backup passkey on a second FIDO2 security key”, in case the first is lost, stolen or damaged.
  4. Password sign-in. Once a passkey is set up, the ACSC refers to ensuring “that the ability to log in to your account using a password is disabled”. Not every service offers this; each service’s help pages say whether it does.
  5. When passkeys aren’t offered. The ACSC refers to using “a different type of phishing-resistant multi-factor authentication.”

How to create a passkey for a Google Account

Based on Google’s instructions (checked October 2026). Menus can change; Google’s guide has the latest steps and device requirements.

  1. Check the device has a screen lock turned on. Google says: “Turn on your phone’s screen lock.” On Apple devices, Google says to turn on iCloud Keychain.
  2. Go to myaccount.google.com/signinoptions/passkeys and sign in.
  3. Select Create a passkey, then unlock your device with your face, fingerprint or PIN.
  4. To use a security key instead, select Use another device, insert the key and enter its PIN or touch its sensor.
  5. Repeat on any other device you want to sign in from.

Google says: “To protect your account from other users, do not create a passkey on a shared device.”

How to create a passkey for a personal Microsoft account

Based on Microsoft’s instructions (checked October 2026). Microsoft’s guide has the latest steps.

  1. On the device where you want the passkey, go to account.live.com/proofs/manage and sign in.
  2. Select Add a new way to sign in or verify.
  3. Choose Face, Fingerprint, PIN, or Security Key.
  4. Follow your device’s prompts.
  5. Select Continue or Create to save it in the suggested place, or Change or Save another way to choose another (such as a password manager, a phone, a security key or Windows Hello on the computer).
  6. Finish by unlocking with your face, fingerprint or PIN if asked.

How to save a passkey on an iPhone or iPad

Based on Apple’s documentation (checked October 2026). Apple’s guide has the latest details.

  1. Sign in to a website or app that supports passkeys, or create a new account.
  2. Open the account settings or security screen for that service.
  3. When the option to save a passkey appears, tap Continue, then follow the on-screen instructions.
  4. To save it on another device or a security key instead, look for Other options or Save on another device (Apple says the labels can vary), if offered.

Apple notes that if no passkey option appears, the site or app doesn’t support passkeys yet.

How to remove a passkey from a lost device (Google example)

Based on Google’s instructions (checked October 2026). Google describes removing the passkey for a lost device from the Google Account.

  1. On a device you can still use, open your Google Account and select Security & sign-in.
  2. Under How you sign in to Google, select Passkeys and security keys.
  3. Select the passkey for the lost device, then select Remove.

Google also points out that “anyone who can unlock your device can access your Google Account”, which is why a strong screen lock matters. The guide to what to do about a lost or stolen phone covers locking and erasing the device itself.

Things to watch for

  • Shared or work devices. The ACSC and Google both describe not creating personal passkeys on devices other people use.
  • Weak screen locks. A passkey is unlocked the same way as the device. A simple or shared PIN weakens it.
  • Losing your only device or key. The ACSC’s backup-key guidance and synced passkeys both exist to avoid this. The guide to planning account recovery explains recovery options.
  • The password still works. Adding a passkey doesn’t always remove the password. Google, for example, describes a Skip password when possible setting rather than removing the password. Where the password still exists, the ACSC’s passphrase guidance still applies to it.
  • Fake “passkey setup” messages. Passkeys are created from within the real app or website. Scamwatch says to “Always type web addresses directly into your browser” rather than following links in messages.

Common questions

What are passkeys and how do they work?

A passkey is a way to sign in without typing a password. It’s a matched pair of digital keys: a public key the website keeps, and a private key that stays on your phone, computer or security key. When you sign in, the device asks for your face, fingerprint or PIN, then answers a challenge only the private key can answer. Google says passkeys “can’t be shared, copied, written down, or accidentally given to someone else.” See how a passkey works.

Are passkeys safer than passwords?

The ACSC describes passkeys as “a faster and more secure way to log in to your online accounts than using passwords”, and the FIDO Alliance says “Phishing resistance is a core design goal of FIDO Authentication.” A passkey is tied to the real website, so a device won’t offer it on a look-alike site. Adding a passkey doesn’t always remove the password, so the ACSC’s passphrase guidance still applies to any password left on the account. See why passkeys resist phishing.

What happens to my passkeys if I lose my phone?

Synced passkeys stay on your other signed-in devices, so losing one device doesn’t remove them. Someone holding the phone would also need to unlock it: Google warns that “anyone who can unlock your device can access your Google Account”, and describes removing the lost device’s passkey from another device. For security keys, the ACSC refers to a backup passkey on a second FIDO2 key. See how to remove a passkey from a lost device.

Do passkeys replace two-factor authentication?

A passkey counts as multi-factor authentication by itself, according to the ACSC: the device is something you have, and the face, fingerprint or PIN is something you are or know. Google’s 2-Step Verification page says signing in with a passkey bypasses the separate second step. Where a service doesn’t offer passkeys, the ACSC refers to using “a different type of phishing-resistant multi-factor authentication.” See what the ACSC’s guidance describes.

Can I use my phone’s passkey on someone else’s computer?

Often, yes, without copying the passkey. Google says that to use your phone’s passkey on another computer, Bluetooth needs to be turned on. Microsoft describes using a phone by scanning a QR code with its camera, which may also need Bluetooth pairing. Creating a passkey on a shared computer is different: Google says “do not create a passkey on a shared device”, and the ACSC describes avoiding devices you share with anyone else. More in things to watch for.

Do I need a security key to use passkeys?

No. Passkeys can be stored on phones and computers, or in password managers such as Google Password Manager and Apple’s Passwords app. The ACSC describes buying “a FIDO2 security key from a reputable store to provide increased protection of your passkeys”, which it says is useful for your most important accounts, and refers to a backup passkey on a second FIDO2 key. The guide to how hardware security keys work explains more.

Where to get official help

Sources

passkeysMFAphishingsecurity keyspasswords