What Is a Passkey? How Passkeys Work and How They Differ From Passwords

What is a passkey?

A passkey is a login credential that replaces a password with a cryptographic key pair stored on your device. You prove who you are by unlocking your device, not by typing a secret.

Passkeys are based on the FIDO2 and WebAuthn standards, developed by the FIDO Alliance and the World Wide Web Consortium (W3C). Apple, Google and Microsoft all support them, which is why the same idea shows up in iPhones, Android phones, Windows and most modern browsers.

The practical result is simple: you tap a sign-in button, your phone or laptop asks for a fingerprint, face scan or PIN, and you are in. Nothing you could write on a sticky note or read out to a scammer is involved.

How do passkeys work?

A passkey works by splitting the login secret in two: a private key that never leaves your device and a public key that the website stores. The website can check your proof without ever holding anything an attacker could reuse.

Here is the sequence when you create and use one:

1. You choose to create a passkey on a website or app that supports them.
2. Your device generates a key pair. The public key is sent to the website; the private key stays on your device (or in your passkey provider).
3. Later, when you sign in, the website sends your device a random challenge.
4. You unlock the private key with a fingerprint, face scan or device PIN. That unlock happens locally and the biometric is not sent to the website.
5. Your device signs the challenge with the private key. The website verifies the signature with the stored public key and signs you in.

Each passkey is also tied to the website address it was created for. A fake site at a look-alike address cannot ask your device for the real site's passkey, which is why passkeys are considered resistant to phishing.

Passkey vs password: what is the difference?

The main difference is that a password is a shared secret you know, while a passkey is a private key your device holds. A shared secret can be guessed, reused, leaked or typed into a fake page; a private key that never leaves the device cannot.

The last row matters for businesses and is covered in its own section below. For one person on their own accounts, passkeys are a clear step up. For a team that shares an account, the picture is more mixed.

Are passkeys safer than passwords?

Yes, passkeys are safer than passwords against the most common attacks, mainly phishing, password reuse and credential stuffing. The US government's CISA guidance and the NIST SP 800-63B digital identity guidelines both favour phishing-resistant authentication of this kind.

They are not magic. Your passkeys are only as safe as the device or account that holds them. If someone gets into your phone and knows its PIN, or takes over the cloud account that syncs your passkeys, they may reach everything those passkeys protect.

Account recovery is the other weak spot. If a site lets anyone reset access with just an email link or a text message, an attacker can skip the passkey and use the recovery route instead.

Where do passkeys work today?

Passkeys work on a growing but still incomplete list of websites and apps, and they depend on your device, browser and operating system supporting them. Large consumer platforms were first, and many smaller business tools still offer only a password plus a one-time code.

Check three things before relying on them:

• The service. Look in the security settings of each account for a "passkey" or "sign in without a password" option. Not every site offers it, and some offer it only for personal accounts.
• Your device and browser. Current versions of iOS, Android, macOS, Windows, Chrome, Edge, Safari and Firefox generally support passkeys, but older systems may not.
• Where the passkey is stored. A synced passkey lives with a provider such as Apple's iCloud Keychain, Google Password Manager, a Microsoft account or a password manager that supports passkeys. A device-bound passkey, such as one on a hardware security key, stays on that one piece of hardware.

Because coverage varies by service, most people will use a mix of passkeys and passwords for years. Keep a strong, unique password and an authenticator code on anything that does not offer a passkey. See how a password manager works if you are not yet storing those in one place.

Why do shared team accounts still need passwords?

Shared team accounts still need passwords because a passkey is designed to belong to one person's device and biometric, not to be handed to several people. Many accounts a business runs are also shared by design, such as a social media page, a supplier portal or a company Google account.

There are a few concrete reasons:

• A passkey is tied to a person. Unlocking it uses your fingerprint, face or device PIN. That is the point for personal security, and the obstacle when a teammate needs the same login.
• Access changes when people join and leave. With a shared password you can change it when someone leaves. Removing one person from a shared passkey is not a routine option on most services.
• Many tools do not support passkeys at all. Ad platforms, banking portals, domain registrars and older admin panels often still rely on a password and an authenticator code.
• Contractors and part-timers. Giving someone limited access to a login without handing over the credential itself needs a tool built for sharing.

The safer pattern for teams is to give each person their own named account with their own passkey wherever the service allows it, and to keep a unique, generated password for the accounts that genuinely must be shared. For the shared ones, store the password in a team password manager rather than a chat thread. Our guide on how to share passwords with your team walks through the options, and sharing a Google account with a team covers one common case.

What happens to two-factor codes when you use passkeys?

A passkey can replace both the password and the second factor in one step, because unlocking it already proves you hold the device and are the person who can unlock it. Many services still keep a separate code for sign-ins that do not use a passkey, and for recovery.

On a shared account, the code usually arrives on one person's phone. That makes one teammate a single point of failure when everyone else is locked out. Sharing 2FA codes with a team explains how to avoid that.

How can a team handle passwords and passkeys together?

A team can handle both by using passkeys for personal logins and a team password manager for shared ones. BobWork Vault is a free password manager for teams that stores shared passwords and authenticator (TOTP) secrets, fills them in the browser and lets you choose what each teammate can do with a login.

For shared accounts, BobWork Vault offers four access levels: Owner, Edit, View and Login only. With Login only, the extension fills the password in but the teammate cannot see or copy it. Everything is encrypted in the browser, so the server stores only ciphertext. For the details, read zero-knowledge encryption explained.

What should you do about passkeys this week?

Start with the accounts that matter most and turn on passkeys wherever they are offered, then tidy up what is left. This checklist works with any password manager or none at all.

1. List your most important accounts: email, cloud storage, banking, domain registrar and social media.
2. For each one, open the security settings and look for a passkey option.
3. Create a passkey on a device you control and note where it is stored (device, platform account or password manager).
4. Make sure you have a second way back in, such as a second device or the service's backup codes, before removing the password.
5. For accounts without passkeys, set a unique password of at least 15 characters (a generated one is best) and an authenticator code.
6. For accounts your team shares, put the password in a team password manager and give each person only the access they need.
7. Review account recovery options and remove old phone numbers and email addresses.

If your team needs one place for the shared logins, create a free BobWork Vault account and invite teammates by email.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• How to share 2FA codes with your team without waiting for one person's phone
• How does a password manager work? The vault, the master password and everything in between
• How to set up a shared Google account for a team without passing one phone around
• What is zero-knowledge encryption in a password manager?

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers