How to Turn On Passkeys: The Password Replacement, Explained

Last updated: October 28, 2026

We may earn a commission if you buy through links here — it never changes our picks.

First: what is a passkey, in plain words?

A passkey is a digital key that lives on your phone or computer and replaces a typed password. Instead of remembering and typing a secret, you unlock the key the same way you unlock your phone — with your face, your fingerprint, or your PIN. That's the whole idea: the proof that it's you is something you have (your device) plus something you are (your face or fingerprint), and there's no password to remember, type, or hand over.

Under the hood — still in plain words — creating a passkey makes a matched pair of keys. One half stays on your device and never leaves it. The other half goes to the website, and on its own it's useless to a thief, because it can only check the half on your device, not impersonate it. When you sign in, your device and the website use the pair to confirm each other, and you approve with your face, fingerprint, or PIN.

Why it's safer than a password

There's nothing to phish. Phishing means a fake site or email tricks you into typing your password into the wrong place. A passkey can't be typed anywhere — and it only works for the exact real website it was created for. A lookalike site gets nothing, because your device won't offer the key for the wrong address.
There's nothing to reuse. Every account gets its own unique key pair, automatically. The classic disaster — one site gets breached and its passwords get tried everywhere else — has nothing to bite on.
There's nothing useful to steal from the website. If a site that holds your public half is breached, the stolen half can't sign in as you. Compare that to a breached password database, which is a master list of skeleton keys.
It's faster, too. No typing, no "forgot password" loop, no code read off your phone. Face, fingerprint, done.

How to create one for a big account

The exact buttons differ a little between services and change over time, so here's the shape of the process rather than a brittle click-by-click. It takes about a minute per account:

Start with an account that matters

Your main email account is the best first candidate — it's the account that can reset everything else — followed by your Microsoft or Apple account and your bank, if it offers passkeys. Sign in to the account the normal way, with your password.

Find the security settings

Open the account's settings and look for the section about security or sign-in. Services that support passkeys put the option there, usually worded something like "Passkeys" or "Add a passkey," sometimes next to the two-factor authentication settings.

Create the passkey and confirm on your device

Choose the option to add a passkey and follow the prompt. Your phone or computer will ask you to confirm it's really you — face, fingerprint, or PIN — and then it creates and stores the key. If you're setting it up on a computer without a built-in option, it may offer to use your phone instead by showing you a code to scan. From your next sign-in onward, the site offers the passkey first: one glance or touch, and you're in.

Repeat for your other important accounts

Not every site offers passkeys yet — adoption is growing but uneven. Add them where they're offered, starting with the accounts that could do the most damage: email, money, and anything that can reset other accounts. Keep a short note of which accounts you've upgraded, so future-you knows what to expect at each sign-in screen.

"What if I lose my phone?"

The sensible worry — and it has a designed answer. For most people, passkeys are stored by your phone's account (your Apple or Google account, or your password manager if you keep them there), and they sync — meaning a copy is kept safely so that when you sign in to your new phone with the same account, your passkeys come back with it. Losing the phone is an inconvenience, not a lockout, as long as you can still get into that main account.

Two habits keep it that way. First, protect the account your passkeys sync through — phone account, email — as carefully as anything you own, since it's now the root of the tree. Second, where a service lets you register more than one passkey (say, one on your phone and one on your computer), do it for your most important accounts: two keys, two devices, no single point of failure.

Where passwords and 2FA still come in

Passkeys don't delete your passwords — on most services, your password stays on the account as a fallback way in, alongside two-factor authentication (the extra code step at sign-in). That means the old advice doesn't retire:

Your fallback password should still be unique and stored in a password manager. A weak, reused fallback quietly re-opens the door the passkey just closed. See our password manager setup walkthrough if you haven't done that step yet.
Keep two-factor on. Where a site has no passkeys, two-factor is still the strongest protection available, and even on passkey accounts it guards the fallback paths.
Expect a mixed world for a while. Some accounts will be passkey-only in practice, most will offer both, and plenty of smaller sites will be passwords-only for years. The 7-step security checklist treats passkeys and two-factor as one combined step for exactly this reason.

The one-sentence summary: a passkey moves the secret off your memory and onto your device, where it can't be tricked out of you — and setting one up takes less time than resetting a forgotten password does.