Passkey

When you create a passkey, your phone or computer makes a private key and a public key for that one site or app. The site stores the public key, which isn’t a secret. The private key stays on your devices, and you approve each use with your face, your fingerprint or your device’s PIN. A passkey works only with the site it was made for, so a fake page can’t ask for it, and a site that leaks its records leaks nothing an attacker can sign in with.

Apple’s iCloud Keychain and Google Password Manager copy passkeys across the devices signed in to your account, end-to-end encrypted, so that neither company can read them. That makes the account, and what it asks for before it trusts a new device, the place your passkeys really live.

In a wallet

Some wallets use a passkey in place of a seed phrase: to lock the wallet’s key, or, on networks like Ethereum, to sign for a smart contract wallet. There are no words to lose, but whoever controls the account controls the wallet. And passkeys don’t pass to heirs: Apple’s Legacy Contact can’t reach them, and Google says it can’t provide login details from a deceased person’s account. The guide on wallets without a seed phrase goes through the trade-offs.

Where they came from

Passkeys are built on standards from the FIDO Alliance and the W3C. Apple, Google and Microsoft committed to support them in May 2022, and by April 2025 more than 15 billion online accounts could use one, according to the FIDO Alliance.