What Is a Passkey?
A passkey lets you sign in without typing a reusable password into a website.
Free video lesson · 1:10
What Is a Passkey?
Cybersecurity Basics for Beginners
Music: “Thinking Music” by Kevin MacLeod. Creative Commons Attribution 4.0.
A passkey lets you sign in without typing a reusable password into a website.
Read the video transcript
A passkey lets you sign in without typing a reusable password into a website. Your device or password manager holds a secret key and proves it has that key when you sign in.
You might unlock the passkey with your fingerprint, face, or device code. That local check allows the sign-in to continue. Your fingerprint is not sent to the website as a password.
The passkey is tied to the service it belongs to. A look-alike website at a different address cannot simply ask for the same passkey and use it there.
That makes passkeys resistant to a common phishing trick: stealing a password through a fake login page. It does not make every message genuine or stop you from sending money to a scammer.
Some passkeys sync across devices. Others stay on one device or security key. Check how yours is stored and how you would recover access if you lost that device.
To keep learning, watch What Is Multi-Factor Authentication? Then try Why Should You Lock Your Screen?
The short answer
A passkey lets you sign in without typing a reusable password into a website. Your device or password manager holds a secret key and proves it has that key when you sign in.
A simple example
You might unlock the passkey with your fingerprint, face, or device code. That local check allows the sign-in to continue. Your fingerprint is not sent to the website as a password.
The passkey is tied to the service it belongs to. A look-alike website at a different address cannot simply ask for the same passkey and use it there.
That makes passkeys resistant to a common phishing trick: stealing a password through a fake login page. It does not make every message genuine or stop you from sending money to a scammer.
Some passkeys sync across devices. Others stay on one device or security key. Check how yours is stored and how you would recover access if you lost that device.
Put it into practice
- Check whether the real service offers passkeys in its security settings.
- Learn whether your passkey syncs or stays on one device or security key.
- Set up the supported recovery options before losing access to a device.
Check your understanding
Can a passkey stop you sending money to a convincing scammer?
Answer
No. It protects a particular sign-in process. You still need to check other requests, including payment instructions.
Explore next
Follow the free video course one question at a time. Teams can practise these habits through security training. For the cryptography protecting your systems, explore a cryptography audit.
Sources