A passkey is a way to sign in without typing a password. Your device creates a pair of cryptographic keys for each website: the website keeps the public key, and the private key stays protected on your phone, computer or password manager. When you sign in, you unlock the passkey with your fingerprint, face or device PIN, and the device proves who you are without sending any secret that could be stolen or phished.
Passkeys are safer than passwords mainly because they cannot be typed into a fake website and are useless if a website's database leaks. They do not yet replace passwords everywhere, and losing all your devices without a recovery plan can lock you out, so set them up together with good account recovery.
How a passkey works, without the maths
Think of a passkey as a special lock and key made for one website only. When you create a passkey, your device makes two matching keys. The website receives one key, called the public key, which can check signatures but cannot create them. Your device keeps the other, the private key, which never leaves the protected storage of the device or password manager.
When you sign in, the website sends a random challenge. Your device asks you to unlock it with your fingerprint, face or PIN, then signs the challenge with the private key. The website checks the signature with the public key. If it matches, you are in. No password crosses the network and nothing reusable is stored on the website.
Your fingerprint or face does not go to the website either. It only unlocks the key on your own device. The website never sees biometric data; it only sees that the correct private key answered the challenge.
A passkey is also tied to the real address of the website it was created for. If a scam page that looks exactly like your bank asks you to sign in, your device simply does not offer the passkey, because the address does not match. That is the biggest practical difference from passwords and one-time codes, which people can be tricked into typing anywhere.
What passkeys protect against, and what they do not
Phishing pages. Because a passkey only works on the real website, look-alike login pages cannot collect it. This removes the most common way accounts are stolen.
Leaked password databases. Websites store only your public key. If their database leaks, attackers get nothing they can use to sign in as you.
Password reuse. Each passkey is unique to one site, so a breach at one service cannot unlock another.
Guessing and brute force. There is no short, human-chosen secret to guess.
Not malware on your unlocked device. If your phone or computer is already infected and unlocked, an attacker may act inside your sessions. Passkeys do not replace keeping devices updated and clean.
Not weak account recovery. If a website lets anyone reset access through an easily intercepted SMS or a guessable security question, attackers may go around the passkey entirely.
Not someone who knows your device PIN. A family member or thief who knows your phone PIN may be able to use your passkeys. Use a PIN that is not your birthday.
Not scams that persuade you to act. If a caller convinces you to transfer money yourself, no sign-in method can stop it. That is a matter of verifying the request, not of technology.
Synced passkeys and device-bound passkeys
There are two broad kinds. Which one you get depends on where you save the passkey.
| Point | Synced passkey | Device-bound passkey |
|---|---|---|
| Where it lives | In a password manager or platform account, synced across your devices | On one physical device, such as a hardware security key |
| If you lose your phone | Restore it on a new device by signing in to the account that syncs it | Lost with the device unless you registered a backup key |
| Convenience | High, works on all your devices | Lower, you need the specific device present |
| Security level | Strong, depends on the security of the syncing account | Very strong, the key cannot be copied |
| Good for | Most people and most everyday accounts | High-value accounts, administrators, people at higher risk |
For most people, synced passkeys are the practical choice. The account that syncs them, for example your main phone platform account, then becomes extra important and should have strong recovery options of its own.
How to start using passkeys safely
Do this gradually, beginning with the accounts that matter most.
- Secure the account that will store your passkeys. Your phone platform account or password manager needs a strong unique password, two-factor authentication and up-to-date recovery details.
- Set a proper screen lock on every device. A six-digit or longer PIN or a password, not a simple pattern or your birthday. Your screen lock now protects your passkeys.
- Add passkeys to your most important accounts. Email first, because email resets everything else, then the accounts that offer passkeys among your shopping, social and work services.
- Keep at least two ways back in. A second device, a backup security key or recovery codes stored offline. Test that you know where they are.
- Leave the password in place for now, but make it strong. Many services still allow a password as a fallback. A weak fallback password undoes much of the benefit.
- Remove passkeys from devices you sell or give away. Factory reset devices properly and remove them from your account's device list.
Banking apps in Vietnam usually use their own sign-in and transaction confirmation inside the app, such as biometrics and in-app codes. Follow your bank's own instructions for those; passkeys mainly matter for email, social media, shopping and work accounts.
Honest limits today
Passkeys are still being adopted. Many websites do not support them, some support them only in certain browsers or apps, and moving passkeys between different ecosystems is improving but not always smooth. Expect a mixed situation for some time.
Shared accounts are awkward. A family streaming account or a shop's shared social media login does not fit neatly into a model built around one person's device. Some password managers allow sharing passkeys within a group; otherwise keep using a strong password with a manager for those accounts.
Older relatives may find the prompts confusing at first, especially when a website asks to "create a passkey" without explaining it. A short walk-through on their own phone usually solves this, and the result, signing in with a fingerprint, is often easier for them than remembering passwords.
None of these limits are reasons to wait. Each account moved to passkeys is one fewer account that can be phished. Start with email and work outward.
Frequently asked questions
Is a passkey the same as using my fingerprint?
Not exactly. The fingerprint only unlocks the passkey stored on your device; the actual sign-in uses a cryptographic key. Your fingerprint is never sent to the website.
What happens if my phone is stolen?
The thief still needs your screen lock to use the passkeys. Sign in to your syncing account from another device, remove the stolen phone and change that account's password; synced passkeys will be available on your new phone.
Can I use a passkey on someone else's computer?
Often yes, by scanning a QR code with your phone, which must be physically nearby. The passkey stays on your phone; remember to sign out of the borrowed computer afterwards.
Should I delete my passwords after creating passkeys?
Only if the service lets you remove the password entirely and you have reliable recovery options. Otherwise keep a strong, unique password stored in a password manager as the fallback.
Are passkeys safe for elderly parents?
Yes, and often easier than passwords, because they sign in with a fingerprint or face. Set a non-obvious phone PIN for them and make sure a trusted family member knows how to help with recovery.
