Passkeys
Register passkeys to sign in with a fingerprint, a face scan or your device lock, keep one per device, and remove the ones you no longer hold.
By the end of this page you will have a passkey registered on the device you are using, and you will know how to add one per device and remove one you no longer hold.
A passkey is a credential kept by your device or your password manager and bound to this application. You unlock it with a fingerprint, a face scan or the device passcode, and it signs you in with nothing typed.
Why passkeys
Nothing to phish
A passkey answers only the web address it was registered for. A fake sign-in page gets nothing.
Nothing to remember
No password to type, save or rotate. The device lock is the only thing between you and your account.
One step, not two
A passkey sign-in skips the two-factor challenge, because the device unlock already proved it was you.
Works offline
No code to receive. It works on a plane and on a flaky connection.
Before you begin
| You need | Why |
|---|---|
| A recent device and browser | Passkeys need the WebAuthn standard: current iOS, macOS, Android, Windows with Windows Hello, or a hardware key. |
| A signed-in session | Passkeys are added from your own security settings. |
A passkey kept in iCloud Keychain, Google Password Manager or a password manager such as 1Password syncs to your other devices signed in to the same account. One kept on a hardware key or an older system stays on that device.
Register a passkey
- Open Settings → Security and find the Passkeys card.
- Press Create a New Passkey.
- Name it after the device or manager that will hold it, such as Work laptop or Phone, so you can tell them apart later.
- Press Generate Passkey. Your browser or operating system takes over with its own prompt and asks where to store the passkey.
- Approve with your fingerprint, face or passcode. The prompt always comes from your device, never from the page.
- The passkey appears in the list with its name and Not used yet.
Register one on every device you sign in from, or keep one in a password manager that follows you. With two passkeys you are never locked out when one device is not to hand.
Sign in with a passkey
Open the sign-in page. Your browser offers the passkey as soon as you focus the email field; pick it and unlock. The flow, and what to do when the browser does not offer it, is on Signing in.
Managing
The list on the Passkeys card shows every passkey of yours with its name and when it last signed you in.
Remove a passkey
Remove a passkey when the device that held it is sold, lost or wiped.
- Press Delete beside the passkey.
- Confirm it is you: type your password, or, on an account without a password, press Confirm with a passkey and unlock one of your other passkeys.
- Press Delete Passkey.
Removing a passkey here invalidates it: a sign-in with it is refused from now on. The credential may still exist in the device's keychain, which is normal; clean it up from the device's own settings.
Replacing a device
Register a passkey on the new device first, confirm it signs you in, then remove the old one. Removing first leaves you with the password alone until the new passkey is in place.
Accounts without a password
An invitation can be accepted with a passkey alone, which leaves the account with no password. Such an account signs in with its passkey, and every place that would ask for the current password asks for a passkey instead: setting a password, removing a passkey, signing other browsers out. If you hold no passkey either, use Forgot your password? on the sign-in page; the emailed link lets you set one.
Permissions
| Action | Who may do it |
|---|---|
| Register or remove a passkey | You, on your own account |
Frequently asked
Related
- Two-factor authentication: the code-based second factor.
- Signing in: the passkey prompt on the sign-in page.
- Browser sessions: sign out the devices you no longer hold.
How is this guide?
Last updated on