Passkeys

A passkey is a credential stored on your device and unlocked with a fingerprint, face or device PIN. There is nothing to remember and nothing to type, and it cannot be phished: the credential is bound to this site and simply will not work on a lookalike.

Adding one

Settings → Security → Passkeys → Add a passkey. Your browser asks how you want to store it: on this device, on your phone, or in your password manager. Name it after where it lives, so "work laptop" and "phone" rather than two entries called "passkey".

Add more than one if you can. A passkey on a laptop and another on a phone means losing either is an inconvenience rather than a problem.

Signing in

Choose Sign in with a passkey on the sign-in page. Your browser offers the passkeys it knows about; unlock and you are in. There is no password step and no second factor to enter, because a passkey is already two factors: something you have, unlocked by something you are or know.

Where they are stored

Depending on your setup, a passkey may be:

• Synced through iCloud Keychain, Google Password Manager or a password manager, and available on every device signed into that account.
• Device-bound, living only on that laptop, phone or hardware key.

Synced passkeys are more convenient; device-bound ones are stricter. Both work here.

Losing a device

Remove that passkey from Settings → Security, and sign in with another passkey, your password, or a sign-in link. Removing a passkey takes effect immediately. If the device was your only way in, use your password and second factor.

Passkeys and two-factor

They are independent. Keeping two-factor on your password means the password route stays protected while the passkey route stays convenient. A workspace that requires two-factor is asking about your account's second factor, not about passkeys.