Passkeys let you sign in with your device's fingerprint, face or PIN instead of typing a password. They are designed to resist phishing, because they only work on the genuine website. This guide shows how to adopt them carefully so you gain the security without risking a lockout.
Step by step
Check your devices are ready
Make sure your phone and computer have a screen lock set up and are running up-to-date software. Passkeys are stored by your device or password manager, so you need to be signed in to the account that syncs them.
Choose where passkeys will be stored
Decide whether passkeys will live in your phone's built-in password manager, your browser or a standalone password manager. Choosing one place that works across your devices makes signing in on a new device much easier.
Start with your main email account
Sign in to your email provider normally, open the security settings and look for the option to create a passkey. Follow the prompts and confirm with your device unlock. Then sign out and back in to check it works.
Add passkeys to other key accounts
Repeat for other important services that support passkeys, such as shopping, social media and cloud storage. Some banks use their own app-based security instead, so follow your bank's guidance rather than expecting a passkey option.
Keep a backup sign-in route
Do not remove every other way to sign in. Keep your password in a password manager, an authenticator app or security key, and saved recovery codes stored safely. This matters if your phone is lost, broken or replaced.
Plan for new and lost devices
Before replacing a phone, confirm your passkeys are synced and that you can sign in on another device. If a device is lost, remove its passkeys or sign it out from each account's security settings once you have secured your main account.
Ready-to-use checklist
- Screen lock set on all devices
- Software up to date
- Passkey storage location chosen
- Passkey created on main email account
- Sign-in tested after creation
- Passkeys added to other key accounts
- Backup sign-in method kept
- Recovery codes stored safely offline
Practical tips
- Name each passkey by device in account settings if the service allows, so you know which to remove later.
- Keep one older family member's setup simple: one storage place and clear written instructions.
- If a website asks for a passkey unexpectedly, check you are on the genuine site before approving.
Common problems
The service does not offer passkeys.
Not every service supports them yet. Use a unique password from your password manager plus 2-step verification with an authenticator app, and check again in future.
I cannot sign in on a friend's or work computer.
Many services let you sign in by scanning a code with your phone, which uses the passkey stored on it. If that is not available, use your backup method, and sign out fully when you finish.
I changed phone and my passkeys have gone.
Sign in to the account that syncs your passkeys on the new phone, as they often reappear once syncing completes. If not, use your backup method to sign in to each service and create a new passkey.