Passkeys are the replacement for passwords, and 2026 is the year they stopped being optional. Google reports more than 800 million accounts using passkeys. Microsoft made them the default for new accounts in 2025. Amazon added 175 million in the first year. If you have not met one yet, you will shortly.
Written September 2026. Adoption figures are the providers’ own published numbers.
What passkeys actually are
A password is a shared secret. You know it, the website stores a version of it, and anyone who obtains it can be you. That is the whole problem: it can be guessed, reused, leaked in a breach, or typed into a convincing fake page.
Passkeys work differently. Your device generates a pair of cryptographic keys. The public one goes to the website; the private one never leaves your device. Signing in means your device proves it holds the private key, usually after you confirm with a fingerprint, a face scan or your device PIN.
Two consequences follow, and they are the entire point. There is no shared secret for a website to leak, so a breach of the site cannot expose your login. And the key is bound to the real domain, so a fake page cannot use it even if the page is a pixel-perfect copy. Passkeys do not merely make phishing harder. They make that particular attack stop working.
Setting up passkeys on each platform
The mechanics are similar everywhere: sign in normally once, then accept the offer to create a passkey. What differs is where it is stored and how it syncs.
Apple
Supported since iOS 16 and macOS Ventura. Passkeys live in the Passwords app and sync through iCloud Keychain, so a passkey made on your iPhone works on your Mac. iCloud Keychain must be switched on, and it is worth confirming that before you start.
Passkeys have been the default for personal Google accounts since late 2023, stored in Google Password Manager and available on Android 9 or later and in Chrome on desktop. Visit your Google Account security settings and look for the passkeys section.
Microsoft
Default for new accounts since May 2025, integrated with Windows Hello. Microsoft reported authentication growth of 120 percent after the change. Business accounts on Entra ID can have them deployed centrally.
The recovery trap, and how to avoid it
This is the part that goes wrong, and it goes wrong in a way that is hard to undo. Because the private key lives on your device, losing every device that holds it can mean losing the account. People enthusiastically delete their password the moment the passkey works, and then break a phone.
Do these three things before you remove a password:
- Save the recovery codes. Most services offer one-time backup codes. Print them or write them down and keep them somewhere physical. A screenshot on the phone you might lose is not a backup.
- Register a second method. A second device, a hardware security key, or an authenticator app. One route into an account is not enough regardless of how good that route is.
- Confirm your passkeys are syncing. Create one on a phone, then check it appears on a laptop. If it does not, your passkeys exist in one place only, which is the situation you are trying to avoid.
The order that works: enrol your email account first, because it is the recovery route for everything else, then your password manager, then your cloud storage, then everything else. Keep passwords in place until you have proven recovery works.
Where passkeys still fall short
- Coverage is uneven. Large services support them well. Your council, your energy supplier and your dentist probably do not, so a password manager remains necessary.
- Shared accounts are awkward. Passkeys tie to people and devices, which makes the household streaming login clumsier than a shared password.
- Cross-ecosystem use is improving but imperfect. An Apple passkey used on a Windows machine generally works through a QR code and Bluetooth, which is more friction than typing.
- Borrowed devices. Signing in on someone else’s computer is harder by design, which is a security feature that occasionally feels like a bug.
None of these is a reason to avoid passkeys. They are reasons to add them alongside a good password setup rather than to burn the old system down on day one. Our password manager guide covers the half of your accounts that will not support passkeys for years yet, and spotting a phishing email is still worth reading, because attackers respond to passkeys by targeting the recovery process instead.
What actually happens when you sign in
It helps to see the exchange, because it explains why the phishing protection is structural rather than a filter that might miss something.
- You click sign in. The site sends your device a random challenge, a one-off number that has never been used before and never will be again.
- Your device checks which site is asking. The private key was registered against a specific domain, and the browser will not offer it to any other domain. A lookalike address simply finds nothing to use.
- You confirm with a fingerprint, face scan or PIN. That unlocks the key on the device. The biometric never leaves the device and is never sent anywhere.
- The device signs the challenge and returns the signature. The site verifies it against the public key it stored at registration.
Nothing reusable crosses the network at any point. There is no string an attacker can capture and replay, which is why a stolen database of these public keys is worth nothing to whoever steals it.
How this differs from two-factor codes
Two-factor authentication improved things, but a six digit code is still a shared secret that a person can be talked into reading out. That is exactly what happens in the common attack: a convincing page, a sense of urgency, and the victim types the code into the attacker’s form. A passkey has nothing to read out. It is a genuine step up rather than another layer of the same idea.
A sensible order to switch
You do not need to convert everything this week. The accounts that matter are the ones that can reset the others, so work outward from those.
- Your main email. It is the recovery route for everything else, so it is the account an attacker actually wants.
- Your password manager, if it supports them.
- Cloud storage and anything holding documents or photos.
- Banking and payment services, which increasingly offer them.
- Shopping and social accounts, which is where breaches are most common but the damage is usually smallest.
Common questions
Are passkeys safer than passwords? Yes, for the two attacks that cause most account compromises. There is no shared secret to steal in a data breach, and a fake site cannot use a passkey because the key is bound to the genuine domain.
What happens if I lose my phone? If your passkeys sync through iCloud Keychain, Google Password Manager or similar, they are on your other devices already. If they do not sync, you need your recovery codes or a second registered method, which is why setting those up first matters.
Do I still need a password manager? Yes. Most smaller sites will not support passkeys for years, and a manager is also where many people now store passkeys alongside passwords.
Can passkeys be phished? The key itself cannot be handed to a fake site. Attackers instead target account recovery, so treat recovery codes and your registered email with the same care you used to give passwords.
Sources and further reading
Where the figures and rules above come from, so you can check them:
- Platform support and adoption figures across Google, Apple and Microsoft: Programming Helper
- Practical guidance on enrolment order and recovery: Daily Cruncher
- Passkeys as an anti-phishing upgrade: AlphaTechFinance
Join the discussion