Practical fixes for the tech you already own. Free, a few times a week.
Lately, more and more websites and apps have started asking the same question after you log in: would you like to create a passkey? Many people tap “not now” and move on without knowing what they’re skipping. The biggest names in tech have been steering everyone in this direction for years, and the shift is now well underway.
The FIDO Alliance, the industry group behind the technology, whose members include Apple, Google and Microsoft, estimated in October 2026 that “7 billion passkeys are in use worldwide.” It also reported that “more than a third of successful sign-ins now use a passkey” across the 15 large consumer services that share data for its annual Passkey Index.
What a passkey actually is
A passkey replaces your password with something you don’t have to remember or type. When you create one, your phone or computer generates a matched pair of digital keys. One, the public key, is stored by the website. The other, the private key, is kept by your device or password manager and is never sent to the website.
When you sign in, the website sends a challenge that only your private key can answer. Your device asks you to confirm it’s you, usually with your fingerprint, your face or the PIN you use to unlock your phone. Then it answers the challenge automatically. You never see a code and never type a password.
Your fingerprint or face scan isn’t sent to the website. It only unlocks the key on your own device.
Why the tech companies are pushing so hard
The main reason is that passwords are the easiest way into most accounts. People reuse them, choose weak ones and type them into fake login pages. Microsoft said it observed more than 7,000 password attacks per second in 2024, double the year before
Passkeys block the most common trick, phishing, by design. A passkey is tied to the specific website it was created for, so your device won’t hand it over to a lookalike site, however convincing the page looks. There is no password or code for a scammer to collect. That is why America’s cybersecurity agency, CISA, describes this technology, known technically as FIDO/WebAuthn, as “the only widely available phishing-resistant authentication” in its guidance on multi-factor authentication.
FIDO’s figures also point to convenience. The alliance reports that passkey sign-ins “succeed more often than passwords and traditional MFA, and are nearly three times faster.” Every participating service that measures phishing reported fewer successful attacks after introducing them.
What the three companies are doing
All three now support passkeys across their platforms. On iPhones and Macs, passkeys are saved in Apple’s Passwords app and iCloud Keychain. On Android and in Chrome, they’re stored in Google Password Manager. Windows supports them through Windows Hello.
Microsoft has gone the furthest with its own accounts. In May 2025, it made new Microsoft accounts passwordless by default. TechRadar reported that new users “will have several passwordless options for signing into their account and they’ll never need to enroll a password,” and that existing users can choose to remove their password entirely. Microsoft said signing in with a passkey was eight times faster than a password plus a second factor.
What happens if you lose your phone
This is the most common worry, and the answer depends on how your passkeys are stored. Passkeys saved in Apple’s, Google’s or Microsoft’s password managers sync to your other devices signed in to the same account, so a new phone restores them. Many sites also let you keep a backup sign-in method, such as a second passkey on another device or a recovery code.
That makes your main Apple, Google or Microsoft account more important than ever. Protect it well, because it now holds the keys to everything else.
Passwords won’t vanish overnight. Plenty of sites don’t support passkeys yet, and you’ll probably keep a password manager for years. But the direction is set, and every passkey you add is one less password that can be stolen.
Enjoyed this?
Get the next one by email. A few times a week, no fluff.
