Passkeys Explained: Why You Should Ditch Passwords Today

For decades, we have relied on complex strings of characters to protect our digital lives. We reuse them, we forget them, and hackers steal them by the billions. The tech industry has finally rallied around a solution that fixes the human error element of security. It is called the passkey. If you are tired of resetting passwords or worrying about data breaches, this guide will walk you through exactly how to set up passkeys on your most critical accounts: Google, Apple, and Amazon.

The Problem With Passwords and the Passkey Solution

To understand why you need to switch, you first need to understand the flaw in the current system. When you use a password, you are sharing a secret with a website. If that website is hacked, your secret is stolen. If you type that secret into a fake phishing site, you have handed the keys to your account to a criminal.

Passkeys operate differently. They are based on standards developed by the FIDO Alliance and the World Wide Web Consortium. Instead of a shared secret, a passkey uses public-key cryptography.

How It Works Under the Hood

When you create a passkey, your device generates a unique pair of cryptographic keys:

  • The Public Key: This is sent to the website (like Google or Amazon). It is useless on its own and poses no risk if stolen from the company’s servers.
  • The Private Key: This stays securely on your device. It never leaves your phone or computer.

When you log in, the website sends a mathematical challenge to your device. Your device uses the Private Key to solve the challenge and sends the solution back. You authorize this action using the same biometrics you use to unlock your phone, such as FaceID, TouchID, or Windows Hello.

Because the website never sees your Private Key, there is nothing for hackers to steal from the server. Because you don’t type anything, you cannot be tricked into entering your credentials on a fake website.

How to Set Up a Passkey on Google

Google has been one of the most aggressive adopters of passkeys. Setting this up protects your Gmail, YouTube, Google Drive, and Google Photos.

Step-by-Step Setup:

  1. Open your browser and navigate to myaccount.google.com.
  2. On the left-hand navigation panel, click on Security.
  3. Scroll down to the section labeled “How you sign in to Google.”
  4. You will see an option for Passkeys. Click on it.
  5. You may be asked to sign in with your current password one last time.
  6. Click the blue + Create a passkey button.
  7. A pop-up will appear asking if you want to create a passkey for this device. Click Continue.
  8. Authenticate using your fingerprint, face scan, or screen lock PIN.

Once active, the next time you sign in to Google on a new device, you won’t need your password. If you are on a computer, Google will display a QR code. Scan it with your phone’s camera, and your phone will approve the login via Bluetooth proximity and biometrics.

How to Set Up a Passkey on Amazon

Amazon accounts are high-value targets for cybercriminals because they contain saved credit card information and shipping addresses. Securing this account is essential.

Step-by-Step Setup:

  1. Go to Amazon.com and log in.
  2. Hover over “Account & Lists” in the top right corner and select Account.
  3. Click on the box labeled Login & security.
  4. Look for the Passkey row. It is usually located below the Two-Step Verification section.
  5. Click the Set up button.
  6. Select Create a passkey.
  7. Follow the browser prompt to authenticate with your device (TouchID, FaceID, or Windows Hello).

Amazon notes that you can stick with your password if you prefer, but once a passkey is active, it becomes the default method for faster checkout and login experiences.

How to Set Up a Passkey on Apple

Apple integrates passkeys deeply into its ecosystem via iCloud Keychain. If you have an iPhone on iOS 16 or later, or a Mac on macOS Ventura or later, you likely already have the infrastructure ready.

For Your Apple ID: Apple automatically assigns passkeys to your Apple ID on trusted devices running the latest software. To verify this or add a new one:

  1. Go to appleid.apple.com and sign in.
  2. Go to Sign-In and Security.
  3. Select Passkeys.
  4. Select Add a Passkey and follow the biometric prompts.

Using Apple Passkeys for Other Sites: When you create a passkey for a site like Kayak, eBay, or Best Buy while using Safari, the passkey is saved to your iCloud Keychain. This means it automatically syncs to your iPad and Mac. If you lose your iPhone, your passkeys are safe because they are end-to-end encrypted in the cloud and can be recovered when you sign into a new Apple device with your iCloud credentials.

What If I Lose My Device?

This is the most common concern users have. If your “key” is on your phone, and your phone falls into a lake, are you locked out forever?

Fortunately, the answer is no. There are three main safety nets:

  1. Cloud Syncing: As mentioned with Apple, passkeys sync across ecosystems. Google uses Google Password Manager to sync passkeys across Android devices logged into the same account. If you break your phone, logging into the replacement phone restores your passkeys.
  2. Cross-Device Authentication: If you need to log in on a Windows computer but your passkeys are on your iPhone, you can select “Use a phone or tablet” on the login screen. A QR code appears. Scanning this bridges the two devices securely.
  3. Hardware Keys: For those who want maximum security without relying on a phone, you can store passkeys on hardware devices like the YubiKey 5 Series. These look like USB drives. You plug them in and tap them to log in. They are indestructible and waterproof, making them excellent backups.

Third-Party Password Managers

You do not have to rely solely on Apple, Google, or Microsoft to store your passkeys. Leading password managers have updated their software to act as passkey wallets.

  • 1Password: Fully supports saving and using passkeys across all browsers and operating systems. This is ideal if you use an iPhone but work on a Windows PC, as it bridges the gap better than iCloud Keychain alone.
  • Dashlane: Offers robust passkey support with a focus on ease of use for beginners.
  • Bitwarden: An open-source option that allows premium users to store passkeys securely.

Using a third-party manager ensures you are not “locked in” to one ecosystem. If you switch from iPhone to Android, 1Password or Dashlane makes moving your credentials much easier than trying to export them from iCloud.

Frequently Asked Questions

Do passkeys replace Two-Factor Authentication (2FA)? Yes. A passkey actually counts as two factors in one. It proves “something you have” (your device) and “something you are” (your biometric scan). Therefore, you do not need to wait for SMS codes or use authenticator apps when using a passkey.

Can I still use my password if I want to? For now, yes. Most websites treat passkeys as an alternative option alongside passwords. However, the industry goal is to eventually remove passwords entirely to eliminate phishing risks.

Does Google or Apple get my fingerprint? No. Your biometric data (face or fingerprint) never leaves your device. The scan simply unlocks the “secure enclave” chip on your phone where the private key is stored. The website only receives a digital signal that the key was unlocked; it never sees your actual fingerprint data.

What happens if I share my Amazon account with my spouse? You can set up multiple passkeys for a single account. You can register your iPhone as a passkey, and then register your spouse’s Android phone as a second passkey on the same Amazon account settings page. Both devices will then have the ability to log in independently.