How to Set Up Passkeys to Replace Passwords

Passwords are a 60-year-old idea holding together the modern internet, and they are failing badly. Verizon's 2024 Data Breach Investigations Report found that stolen credentials were involved in roughly one out of every three breaches, and phishing remains one of the most reliable ways attackers get in. If you have ever reused a password, written one on a sticky note, or clicked a login link that looked slightly off, you already know why the whole system feels fragile.

Passkeys are the replacement that is finally practical. They are built on public-key cryptography, they can't be phished in the traditional sense, and every major platform now supports them: Apple, Google, Microsoft, plus hundreds of services from GitHub to Amazon. The catch is that the setup experience is inconsistent, and most people don't understand what a passkey actually is before they enable one. That leads to lockouts, abandoned setups, and a false sense that "it didn't work."

This guide fixes that. You'll learn exactly what a passkey is, how to set up passkeys on the accounts that matter most, how syncing and device-bound keys differ, what happens if you lose your phone, and how passkeys fit alongside your existing password manager. I use passkeys daily across three operating systems, so this reflects what actually works, not just what the spec promises.

Key Takeaways

A passkey replaces your password with a cryptographic key pair: the private key never leaves your device, so there's nothing for attackers to steal or phish.

Start with your most valuable accounts (email, banking, password manager, cloud storage) and add passkeys there first.

You can keep your password as a fallback while you test passkeys, so there's no risk of lockout during the transition.

Synced passkeys (via iCloud, Google Password Manager, or a third-party app) are convenient; device-bound passkeys (like a YubiKey) are more secure but need backups.

Set up at least two passkeys or one strong recovery method per account before deleting anything.

A dedicated password manager still matters; passkeys and managers are partners, not competitors.

What Exactly Is a Passkey?

A passkey is a digital credential based on the FIDO2 / WebAuthn standard. Instead of a shared secret you type in, it uses a pair of cryptographic keys. When you create a passkey for a website, your device generates two keys:

A private key that stays locked on your device (or in your synced keychain) and never gets transmitted.
A public key that gets stored on the website's server.

When you log in, the site sends a challenge. Your device signs it with the private key, and the site verifies the signature using the public key it already has. You approve the whole thing with Face ID, a fingerprint, or your device PIN. The password never travels across the network, because there is no password.

This design kills the two biggest attack categories at once. A phishing site can't trick you into handing over a passkey, because the passkey is cryptographically tied to the real domain. And a server breach that leaks the site's stored public keys gives attackers nothing useful, since the public key alone can't authenticate you.

Passkey vs. Password vs. Password + 2FA

People often ask whether a passkey is "just fancy two-factor authentication." Not quite. A passkey typically combines two factors in one step: something you have (the device holding the private key) and something you are or know (biometrics or PIN). Here's how the three approaches compare.

Criterion	Password only	Password + SMS 2FA	Passkey
Phishing resistance	None	Weak (codes can be phished)	Strong (domain-bound)
Survives server breach	No (hashes crackable)	Partial	Yes (public key only)
Login speed	Slow (type + recall)	Slowest (type + wait for code)	Fast (one tap/scan)
Reuse risk	High	High	None (unique per site)
Works offline	Yes	No (needs SMS)	Yes
Setup difficulty	Trivial	Moderate	Moderate (once)

A Realistic Before-and-After Scenario

Let's make this concrete. Say you have 47 online accounts spread across email, banking, shopping, social media, and work tools. Of those, maybe 5 are genuinely critical: your primary email, your bank, your password manager, your cloud storage, and your main work identity provider.

Before passkeys: You reuse a "strong" password across 6 shopping sites, use SMS 2FA on your bank, and rely on your memory for the rest. If one shopping site leaks its database, credential-stuffing bots can try that combination against your email within hours. Your average login takes about 15 seconds when you factor in autofill failures and 2FA codes.

After passkeys: You add passkeys to the 5 critical accounts first. Each login is now a single Face ID scan taking roughly 3 seconds. There's no reusable secret to steal, so a shopping-site breach no longer endangers your email. You keep passwords on the low-value accounts for now and migrate them over the next month.

The math on time alone is striking: if you log into those 5 accounts an average of 4 times a day, saving 12 seconds each time is about 4 minutes daily, or roughly 24 hours a year. The security gain is the real prize, but the convenience is what makes passkeys stick.

How to Set Up Passkeys on Your Most Important Accounts

The general flow is the same everywhere: go to the security settings of an account, find the passkey option, authenticate once, and confirm. Below are detailed walkthroughs for the platforms most people start with.

Step 1: Choose Where Your Passkeys Will Live

Before creating a single passkey, decide on a "home" for them. Your options:

Apple ecosystem: iCloud Keychain syncs passkeys across iPhone, iPad, and Mac. Requires two-factor authentication on your Apple ID.
Google: Google Password Manager syncs passkeys across Android and Chrome on any OS.
Microsoft / Windows Hello: Stores passkeys tied to your Windows device or Microsoft account.
Third-party password managers: 1Password, Bitwarden, and Dashlane now store and sync passkeys cross-platform, which is ideal if you switch between operating systems.
Hardware keys: YubiKey or similar for device-bound, high-security passkeys.

If you already use a dedicated password manager, storing passkeys there keeps everything in one vault regardless of device. If you haven't moved off your browser's built-in manager yet, our guide on migrating from your browser's password manager to a dedicated app is a good prerequisite.

Step 2: Set Up a Passkey for Google

Go to myaccount.google.com and sign in.
Open the Security section from the left menu.
Scroll to "How you sign in to Google" and select Passkeys and security keys.
Click Create a passkey. If your device supports it, Google may have auto-created one already; you can add more.
Authenticate with Face ID, fingerprint, or your device PIN when prompted.
Confirm the passkey appears in the list with today's date.

To test it, sign out and sign back in. Google will offer "Use your passkey" and skip the password entirely.

Step 3: Set Up a Passkey for Apple ID

On iOS and macOS, passkeys are largely automatic once iCloud Keychain and two-factor authentication are enabled. To confirm:

On iPhone, open Settings and tap your name at the top.
Go to iCloud then Passwords and Keychain and make sure it's on.
Any site that supports passkeys will now offer to save one to your keychain when you register.

Step 4: Set Up a Passkey for Microsoft

Visit account.microsoft.com and sign in.
Go to Security then Advanced security options.
Under "Ways to prove who you are," choose Add a new way to sign in.
Select Use your face, fingerprint, PIN, or security key.
Follow the Windows Hello or hardware key prompt to complete registration.

Step 5: Add Passkeys to Third-Party Services

GitHub, Amazon, PayPal, eBay, WhatsApp, and hundreds more now support passkeys. The pattern is consistent: Settings → Security → Passkeys → Add a passkey. On GitHub, for example, go to Settings → Password and authentication → Passkeys → Add a passkey, then authenticate. The whole thing takes under a minute per site.

Synced vs. Device-Bound Passkeys: Which to Choose

This is the decision that trips people up most. There are two flavors of passkey and they solve different problems.

Synced Passkeys

Synced passkeys live in a cloud keychain (iCloud, Google, or a manager like Bitwarden) and follow you across every device signed into that account. If your phone falls in a lake, your passkeys are still safe in the cloud and available on your other devices. This is the right default for the vast majority of people because it eliminates the biggest passkey fear: permanent lockout.

Device-Bound Passkeys

Device-bound passkeys never leave the physical hardware they were created on. A YubiKey is the classic example. These are the gold standard for high-value targets like journalists, executives, and admins, because there is literally no cloud copy to compromise. The tradeoff is that you must register a backup key, or losing the device means losing access.