What is a passkey
A passkey is a way to sign in to a website without typing a password. Instead of a secret that you remember and the site stores, a passkey is a pair of cryptographic keys that your device creates for that one site.
The key pair
One half of the pair is the public key. The site keeps it and uses it to check your identity. The other half is the private key, which stays on your device and never goes to the site. When you sign in, the site sends a random challenge. Your device unlocks the private key with your face, fingerprint or screen-lock PIN, signs the challenge, and sends back the signature. The site checks the signature with the public key and lets you in.
Because the site holds only public keys, a stolen database gives an attacker nothing they can sign in with. There is also no password for you to reuse, forget or get wrong.
Why phishing does not work
A passkey is tied to the real address of the site it was made for. If you land on a fake page that looks the same, your browser will not offer the passkey, because the address does not match. A person can be tricked into typing a password into a copy of a site, but they cannot be tricked into handing over a passkey. This is the biggest gain over passwords and over codes sent by text message, which a fake page can ask for and pass along.
Where passkeys are stored and synced
A passkey can live on one device, but most people want it on all of their devices. Apple devices sync passkeys through iCloud Keychain. Android and Chrome sync them through Google Password Manager. Windows can keep them in Windows Hello on that machine, and phones can approve a sign-in on a computer by scanning a QR code. Password managers such as 1Password and Bitwarden can also store and sync passkeys across systems, which helps if you use devices from different makers.
What happens if you lose the device
If your passkeys are synced, a lost phone is a smaller problem. Get a new device, sign in to your Apple, Google or password manager account, and your passkeys return. Protect that account well, because it now holds your keys. If you used a passkey that is stored on only one device or one security key, you need another way back in. Most sites let you keep a password or a recovery code as a backup, and it is wise to add a second passkey or a spare security key.
Passkeys, passwords and two-factor codes
A password is something you know. It can be guessed, leaked and phished. A two-factor code adds a second step, which helps, but a code typed into a fake page can still be stolen in real time. A passkey replaces both steps with one: you have the device, and you prove it is you with a face, finger or PIN. The result is faster than typing a password and a code, and much harder to attack.
Passkeys are not perfect. Not every site offers them yet, and moving between ecosystems can be awkward. For now, most people use passkeys where they are offered and keep strong, unique passwords, ideally long passphrases, for the rest. Pair that with a password manager and you will type very little.
If you run your own web apps
If you host tools for yourself or a small team, you can offer passkey sign-in too, rather than a shared password. That means one sign-in in front of every app, with no password database to protect. The cards above show one way to do it.
Frequently asked questions
Does this page create a passkey on my device?
No. The page only asks your browser which features it has. It never starts a sign-in or a registration, so you will see no prompt and nothing is saved on your device or anywhere else.
Does the checker send anything to a server?
No. Every check runs inside this page, and the page blocks network connections with a content security policy. There is no tracking and no analytics. You can turn off your connection after the page loads and the checker still works.
Which browsers and devices support passkeys?
Safari on iOS and iPadOS 16 and newer, Safari on macOS Ventura and newer, Chrome and Edge on Windows, Mac, Linux and Android 9 and newer, and Firefox on desktop all support passkeys in current versions. Support is best when the device has a screen lock and the operating system's passkey storage is turned on.
The checker says No. What should I try first?
Update your operating system and browser, then press Check again. Make sure the device has a screen lock, such as a passcode, fingerprint or face unlock. On Windows, set up Windows Hello. If the device is too old to update, use a phone to sign in by scanning a QR code, or buy a hardware security key.
What does Unknown mean?
Unknown means the browser did not give a clear answer. Some browsers hide details for privacy, and some features are new and not offered everywhere yet. It does not mean you cannot use passkeys. Try Check again, or try another browser.
What is passkey autofill?
Autofill, also called conditional mediation, lets your browser offer your passkey as a suggestion when you click the username box on a sign-in page. You pick it and unlock with your face, finger or PIN. Without autofill you can still use passkeys, but the site must show a separate passkey button.
Why does the browser and system name say approximate?
The page reads the user agent text your browser sends, which can be wrong or hidden. Some browsers on iPad pretend to be a Mac, and browser extensions can change the text. The feature checks above do not rely on it, so trust those rows first.
Can I use passkeys without Face ID or a fingerprint reader?
Yes. A passkey needs some way to confirm it is you, and that can be a device PIN or password. You can also use a hardware security key, or a passkey on your phone through a QR code. A fingerprint or face scan is convenient but not required.