Here’s how to set up passkeys on the three big accounts. Google: open myaccount.google.com → Security & sign-in → Passkeys and security keys → Create a passkey, then unlock your phone or PC. Microsoft: open account.live.com/proofs/manage → Add a new way to sign in or verify → Face, Fingerprint, PIN, or Security Key.
Apple: passkeys are saved in iCloud Keychain, so turn on Settings → [your name] → iCloud → Passwords → Sync this iPhone. Before you rely on passkeys, check your recovery phone and email so a lost phone doesn’t lock you out.
Passkeys are the biggest change to how we sign in since two-step verification. This guide covers what they are, step-by-step setup for Google, Microsoft and Apple accounts, how to use them on other people’s computers, and the question everyone asks first: what happens if you lose your phone? It’s the main guide in our security hub.
How we wrote this: the Google and Microsoft steps are for an Android phone (we use a Samsung Galaxy) and a Windows 11 PC, checked against Google’s and Microsoft’s support pages. We don’t use an iPhone or Mac, so the Apple section is based on Apple’s support pages and hasn’t been tested by us. Menus change often; if a label on your screen differs, the official pages in the Sources list are the reference.
What is a passkey?
A passkey is a sign-in credential that lives on your device (or in your password manager) instead of in your head. When you sign in, you unlock it the same way you unlock your phone or PC: fingerprint, face, PIN or pattern. The website never sees your fingerprint or PIN; that stays on your device.
Behind the scenes, each passkey is a pair of cryptographic keys. The website keeps the public key. Your device keeps the private key and uses it to sign a one-time challenge when you log in. Because the private key never leaves your device and there’s nothing to type, there’s no password for a hacker to steal from the website or trick you into entering.
Passkeys vs passwords: why it matters
| Question | Password | Passkey |
|---|---|---|
| How you sign in | Type something you remember | Unlock your device with face, fingerprint or PIN |
| Can it be phished? | Yes, you can type it into a fake site | No, a passkey only works on the real site it was made for |
| Can it be reused? | Often is, across many sites | No, each passkey is unique to one account |
| Leaked in a data breach? | Yes, if the site is breached | The site only stores a public key, which is useless to attackers |
| Needs a separate 2FA code? | Usually, for good security | No, it combines your device with your fingerprint, face or PIN |
That phishing point is the big one. Many account takeovers start with a fake login page; Instagram’s own help pages, for example, warn about messages that link to look-alike login sites. A passkey simply won’t work on a look-alike domain, so the trick fails even if you click the link.
Synced passkeys vs device-bound passkeys
- Synced passkeys are backed up to a password manager such as Google Password Manager, iCloud Keychain or Microsoft Password Manager. They appear on your other signed-in devices, which is what most people want.
- Device-bound passkeys stay on one device or one hardware security key. They’re the most secure option, but if that device is lost, so is the passkey. Passkeys saved only to Windows Hello are device-bound.
Before you start: a 5-minute checklist
- Your phone or PC has a screen lock (PIN, pattern, fingerprint or face). Passkeys can’t be created without one.
- Your devices are reasonably up to date. Google and Microsoft list Windows 10 or later, macOS Ventura or later, ChromeOS 109 or later, Android 9 or later and iOS 16 or later.
- Your browser supports passkeys: Chrome or Edge 109+, Safari 16+, or Firefox 122+ (per Google’s support page).
- Your recovery phone number and recovery email are correct on each account. This is your safety net if a device goes missing.
- Bluetooth is on if you plan to sign in on a computer using your phone.
How to set up passkeys for your Google account
Google was one of the first big services to offer passkeys, and if you use an Android phone you may already have one. Google says passkeys can be registered automatically for Android devices signed in to your account.
On an Android phone (Samsung Galaxy)
- Open Settings → Google → Manage your Google Account, or go to myaccount.google.com in Chrome.
- Tap Security & sign-in.
- Under How you sign in to Google, tap Passkeys and security keys. You may need to confirm your password.
- Tap Create a passkey, then Create a passkey again (or Continue).
- Confirm with your fingerprint, face or screen lock. If your Galaxy asks where to save it (Google Password Manager or Samsung Pass), pick the one you use on your other devices.
On a Windows 11 PC
- In Chrome or Edge, go to myaccount.google.com/signinoptions/passkeys and sign in.
- Select Create a passkey.
- Choose where to save it. In Chrome, saving to Google Password Manager makes it sync to your other devices. Choosing Windows Hello or this Windows device keeps it on this PC only.
- Confirm with your Windows Hello PIN, face or fingerprint.
Since late 2024, Chrome can sync passkeys saved in Google Password Manager across Windows, macOS, Linux, Android and (on iOS 17 or later) iPhone. The first time you use a synced passkey on a new computer, Chrome asks for your Google Password Manager PIN or your Android screen lock. That PIN keeps the synced passkeys end-to-end encrypted, so remember it.
Turn on “Skip password when possible”
Once a passkey exists, Google can ask for it first instead of your password. This setting is Skip password when possible under Security & sign-in. Keep it on to get the full benefit. Your password still works as a backup sign-in method.
How to set up a passkey for your Microsoft account
Your Microsoft account covers Outlook, OneDrive, Xbox, Microsoft 365 and Windows sign-in. Since May 2025, brand-new Microsoft accounts are passwordless by default, and existing accounts can add passkeys and even remove the password entirely.
On a Windows 11 PC
- Go to account.live.com/proofs/manage (this is the Advanced security options page) and sign in. You can also reach it from account.microsoft.com → Security.
- Select Add a new way to sign in or verify.
- Choose Face, Fingerprint, PIN, or Security Key.
- Windows suggests a place to save the passkey. Select Continue or Create to accept, or Change to pick another option (such as your phone or a security key).
- Confirm with Windows Hello, then give the passkey a name you’ll recognize, such as “Home PC”.
On an Android phone
On the same page, choose Change when Microsoft suggests a location and pick your phone. You can save the passkey on the phone itself, or scan a QR code shown on your PC with the phone’s camera. Microsoft also supports saving passkeys in the Microsoft Authenticator app.
Where Windows 11 keeps your passkeys
Open Settings → Accounts → Passkeys to see every passkey saved on the PC. You can search, sort and remove them from the three-dot menu with Delete passkey. Under Advanced options you can turn on supported third-party passkey managers (Microsoft added this in its November 2025 update, starting with 1Password and Bitwarden). For more Windows housekeeping, see Windows 11 settings to change after you upgrade.
Passkeys for your Microsoft account itself are managed online, not in Windows Settings. Go back to account.live.com/proofs/manage to rename or remove them.
Optional: remove your Microsoft account password
Microsoft lets existing accounts go fully passwordless from Advanced security options → Passwordless account. This usually requires the Microsoft Authenticator app. Only do this after you have at least two working sign-in methods (for example, a passkey on your PC and Authenticator on your phone), plus an up-to-date recovery email.
How to set up passkeys on iPhone, iPad and Mac (Apple)
We didn’t test this section on Apple devices. It’s based on Apple’s support pages for the current iOS and macOS versions.
Apple handles passkeys a little differently. There’s no single “create a passkey” page for your Apple Account. Instead, your iPhone, iPad or Mac creates passkeys for the websites and apps you use and stores them in iCloud Keychain, where they sync across devices signed in to the same Apple Account. Apple says they’re end-to-end encrypted and not visible to anyone, including Apple.
Step 1: Turn on iCloud Keychain
- Make sure two-factor authentication is on for your Apple Account. Apple requires it for iCloud Keychain.
- On iPhone or iPad, open Settings → [your name] → iCloud → Passwords and turn on Sync this iPhone (on iOS 17 or earlier the menu is Passwords and Keychain).
- On a Mac, open Apple menu → System Settings → [your name] → iCloud → Passwords and turn on Sync this Mac (on macOS Sonoma or earlier: Passwords & Keychain).
Step 2: Save a passkey when a site offers one
When you sign in to a site or app that supports passkeys, such as your Google account, it will offer to create one. Accept, confirm with Face ID or Touch ID, and the passkey is saved to iCloud Keychain. To set up passkeys for Google on iPhone, use the Google steps above in Safari or Chrome; to set one up for Microsoft, use the Microsoft steps.
From iOS 18 and macOS Sequoia onward, you can see and manage saved passkeys in Apple’s Passwords app. Apple also describes a Sign in with Passkey option on Apple’s own websites that uses your iPhone or iPad to sign in. On Windows, the iCloud for Windows app can make iCloud passwords available in Chrome and Edge.
Using a passkey on another computer
You don’t need your passkey stored on every device. To sign in on a PC that isn’t yours (or a new laptop), pick the option to use a phone or tablet when the site asks for a passkey. A QR code appears; scan it with your phone’s camera and confirm with your fingerprint or face. The two devices check they’re physically close using Bluetooth, which stops someone using a QR code from far away.
On a shared or public computer, don’t save a new passkey there and don’t stay signed in. Use the QR code method, then sign out when you’re done.
What if I lose my phone?
This is the most common worry, and it’s a fair one. The short answer: losing a phone is an inconvenience, not a disaster, as long as you set up a backup before it happens.
- Synced passkeys come back. Passkeys in Google Password Manager or iCloud Keychain are restored when you sign in to your account on a new phone and verify it’s you (for Google, with your Password Manager PIN or old screen lock; for Apple, with a trusted device or device passcode).
- Device-bound passkeys don’t. A passkey saved only in Windows Hello or on a security key is gone if that device is lost. Microsoft’s advice is to create passkeys on more than one device, as “spare keys”.
- Your other sign-in methods still work. Google keeps your password and recovery options. Microsoft can send a code to your recovery email or phone, or use the Authenticator app.
- Remove the lost device. Sign out of the missing phone from your Google account’s device list and remove its passkey from your Microsoft account so it can’t be used.
Our recommended backup setup
- At least two devices with passkeys for each important account (for example, your phone and your PC).
- An up-to-date recovery email and phone number on Google, Microsoft and Apple.
- Your Google Password Manager PIN written down somewhere safe at home.
- Optional: a hardware security key kept somewhere safe, for your most important accounts.
Setting up a new phone soon? Our guide to setting up a new Android phone the right way covers moving accounts across without locking yourself out.
Common problems and fixes
| Problem | Likely cause | What to try |
|---|---|---|
| No “Create a passkey” option | No screen lock, or an old browser or OS | Set a screen lock or Windows Hello PIN, then update your browser and system |
| Phone QR sign-in fails | Bluetooth is off on one device | Turn on Bluetooth on both the phone and the computer and keep them close |
| Passkey not showing on a new PC | It was saved to Windows Hello, not a synced manager | Create another passkey on the new PC, or sign in with your phone’s QR code |
| Chrome asks for a PIN | First use of Google Password Manager passkeys on that device | Enter your Google Password Manager PIN or Android screen lock |
| Work PC won’t save passkeys | Your organization has turned the feature off | Ask your IT team; use your phone instead |
Are passkeys worth it? Our take
For most people, yes. Passkeys are faster than typing a password, and they shut down the most common way accounts get stolen: fake login pages. Start with the accounts that unlock everything else, which are your Google, Microsoft or Apple account and your main email.
Passkeys don’t protect you from every scam, though. They won’t stop someone talking you into sending money, like the AI voice-clone scam calls we covered recently, or a fake shopping deal. Pair them with good habits around spam calls and spam texts. If an account has already been taken over, see how to recover a hacked Instagram account, and steer clear of “tools” that ask for your login, like the private Instagram viewer scams. Worried about the device itself? Read how to tell if your phone has been hacked.
FAQ
Are passkeys safer than passwords?
Yes. A passkey can’t be guessed, reused on another site or typed into a fake login page, and the website only stores a public key that’s useless if leaked. That’s why they stop most phishing.
Can I use a passkey on someone else’s computer?
Yes. Choose the option to use a phone or tablet, scan the QR code with your phone, and confirm with your fingerprint or face. Bluetooth needs to be on for both devices. Nothing is saved on their computer.
Do I still need my password after setting up passkeys?
Keep it for now as a backup. Google keeps your password as a backup alongside passkeys. Microsoft lets you remove the password, but only do it once you have at least two other ways to sign in.
What happens to my passkeys if I lose my phone?
Passkeys synced through Google Password Manager or iCloud Keychain come back when you sign in on a new device. Passkeys saved only on the lost device are gone, so keep a second device or recovery method.
Can I use passkeys on Android and iPhone together?
Yes. Since January 2025, Chrome can sync Google Password Manager passkeys to iPhone and iPad (iOS 17 or later, with Chrome set as the AutoFill provider), and any phone can sign in on another device with the QR code method.
Sources
- Sign in with a passkey instead of a password — Google Account Help
- Create and save a passkey — Microsoft Support
- Manage your saved passkeys — Microsoft Support
- What are passkeys and why they matter — Microsoft Support
- Pushing passkeys forward: Microsoft’s latest updates (May 2025) — Microsoft Security Blog
- Passkeys on Google Password Manager are now available on iOS — Chrome for Developers
- Set up iCloud Keychain — Apple Support
- Use the Passwords app to manage passwords and passkeys — Apple Support
- Passkeys — FIDO Alliance
