Set up passkeys – sign in without a password on iPhone, Android and Windows

A passkey is based on the FIDO2 standard of the FIDO Alliance, an industry consortium. According to NCSC Switzerland, its core consists of two protocols: CTAP2 between the device and the «authenticator», and the W3C's WebAuthn between the browser and the server. During setup, your device generates a random key pair for precisely this service: the private key stays on the device or in the authenticator, the public key goes to the service. Apple describes the same thing: the server never learns what the private key is, and the public key is not a secret – there is no longer a «shared secret» that anyone could steal.

Signing in works as a challenge-response: the service sends a challenge, your device signs it with the private key after you unlock it, and the service checks the signature with the public key. Because the service's address is embedded in the challenge and the authenticator checks it before signing, the response is only good for the genuine target server. NCSC Switzerland writes that WebAuthn thereby effectively protects against phishing and «Mallory-in-the-middle» attacks; Microsoft puts it concretely: a passkey for netflix.com only works with netflix.com, and on a deceptively similar site your device will not even present it.

According to NCSC Switzerland, the word now means two things: the technology of synchronisable FIDO keys and the individual private key that replaces the password. Your fingerprint and face are only the door opener to the key on the device – according to Google and the Chrome help page, the biometric data stays on the device and is not shared with Google. A detailed glossary page «What is a passkey?» will be published on 4 November 2026.

In its technology brief «Passkeys» of September 2025, NCSC Switzerland notes that no general statements can be made about the security of passkeys, because the devil is in the particular implementation – nevertheless, «passkeys are more secure than passwords for at least three reasons»: first, they are unique to each target server and would have to be obtained separately by an attacker, whereas passwords are often reused for many services. Second, they are generated pseudo-randomly and cannot easily be guessed. Third, they are not transmitted over data communication channels, so they can be neither intercepted nor reused in «replay» attacks. NCSC Switzerland expressly welcomes and supports the development and expects FIDO2 to become established in the form of various passkey implementations – Google, Apple and Microsoft are replacing passwords with passkeys wherever possible.

How far that has already come is shown by the FIDO Alliance in its announcement of 15 October 2026: around 7 billion passkeys worldwide, and at the 15 consumer services of its «Passkey Index» – among them Amazon, Google, Microsoft, PayPal, Shopify, TikTok and WhatsApp – «more than a third of successful sign-ins» now run via a passkey, nearly three times faster than with a password and a classic second factor. According to FIDO, every participant that measures phishing has since reported fewer successful attacks. Google adds the everyday benefit on its help page: passkeys cannot be shared, copied, written down or accidentally given to someone else.

For you that means: the passkey takes the two biggest password risks off your hands – reuse and phishing. What it does not take off your hands is looking after the fallback: as long as a service keeps your password, it has to be strong and unique (→ Create a strong password – and what is actually secure in 2026), and for services without passkeys the second factor remains the best protection (→ Set up 2-Step Verification on your Google Account – prompts, app, key or passkey).

Originally, according to NCSC Switzerland, the private key was to be stored permanently and unreadably in the authenticator («device-bound authenticator»). Because that is impractical with several devices, the FIDO Alliance added synchronisation via cloud storage («synced authenticators») – and that is exactly what the passkeys in iCloud Keychain, Google Password Manager, Microsoft Password Manager and in password managers are. NCSC Switzerland says clearly that this flexibility «usually comes at the expense of security» and that the hardware protection originally intended was relaxed to enable broader market adoption; how far an implementation departs from the standard has to be examined case by case. The FIDO Alliance has three certification levels for this: L1 allows any hardware and software, L2 requires a Secure Element or a Trusted Execution Environment, L3 an environment approved by the Alliance – for NCSC Switzerland this classification is not granular enough for security analysis.

In its technology brief «Security categories for authentication procedures, methods and services» of September 2026, NCSC Switzerland sorts the methods: a password alone sits in «low», synced passkeys in «medium*», FIDO2 hardware keys without synchronisation in «high*» – the asterisk marks methods that protect against real-time phishing. Both kinds of passkey are therefore phishing-resistant; the difference lies in whether the key stays in dedicated hardware or can be copied to several devices via a cloud. Apple counters that iCloud Keychain is end-to-end encrypted with keys not known to Apple, and that passkeys remain recoverable even if you lose all your devices.

Our practical recommendation: for private individuals, synced passkeys are the right choice – in iCloud Keychain, in Google Password Manager, in Microsoft Password Manager or in an independent password manager if you use devices from different makers (→ Best password managers 2026: 1Password, NordPass, Bitwarden and Proton Pass compared). That solves the loss scenario, and you are protected against phishing. For particularly important accounts – email, password manager, bank – a hardware key is worth adding, ideally two, because it cannot be recovered.

With the Google Account, the passkey has been the default option for personal accounts since 10 October 2023; with the Apple Account and with websites in Safari it runs via iCloud Keychain; with the Microsoft account via the «Advanced Security Options». On 25 August 2026 WhatsApp reported that more than a billion people protect their account with a passkey – after the wave of hijacked accounts in Switzerland, a good reason to turn it on there (→ Fake voting links hijack WhatsApp accounts: over 50 reports in October – Switzerland's NCSC warns). The 15 services in the FIDO Alliance's Passkey Index, including Amazon, PayPal, Shopify and TikTok, offer it too.

Not every app and website is there yet. Apple, Google and Microsoft say it in the same words: if you do not see an option for a passkey when signing in or in the account settings, the service does not currently support it. Then it is password plus second factor – and a look at the security settings again in a few months.

New is automatic passkey creation: when you sign in with a saved password, the website can create a passkey in the background. Apple describes this for websites and apps, Chrome saves it in Google Password Manager and informs you, Edge stores it in Microsoft Password Manager. If you do not want that, turn off the option «Automatically create a passkey to sign in faster» in Chrome under «Passwords and autofill» > «Google Password Manager» > «Settings», and in Edge the option «Automatically upgrade to passkeys» under «Settings» > «Passwords and autofill» > «Microsoft Password Manager» > «More settings». Your existing sign-in details remain in both cases.

The password remains. NCSC Switzerland points out that many uses of passkeys still allow or even require the continued use of passwords, for example as a backup for resets – so weak passwords and poor password management remain realistic attack vectors. Anyone who sets up a passkey and keeps the old password that is the same everywhere has merely overlooked the back door, not closed it.

The device is the key. Google writes that once you have created a passkey, anyone who can unlock your device can access your Google Account, even if you have signed out there. So: no passkeys on shared devices, the screen lock is a must, and a passkey that has accidentally ended up on someone else's device is removed from the account immediately. Accounts from an employer or school can be restricted, according to Google and Microsoft – Google Workspace only allows sign-in with just a passkey if the administrator permits it, and Microsoft organisations can block storage locations. And in Incognito mode, Google says, passkeys do not work on some systems.

Moving passkeys is not solved yet. NCSC Switzerland names the Credential Exchange Format and Protocol, with which passkeys could be exported and imported individually, but supported only in some implementations; our research with the four password managers confirms the picture, from Bitwarden with CXP to NordPass with no export at all. And a passkey does not protect you against malware on your own device or against phone fraud in which someone pressures you into approving a sign-in. Keep your operating system and browser up to date – Google names that as a requirement for passkeys to work securely (→ Apple patches 329 security flaws in one go – and finally brings older iPhones the fix for an exploited bug) – and read how fraudsters fake bookings and payments (→ Hotel phishing with a 7.5 per cent «cashback» targets TWINT accounts – Switzerland's NCSC warns).

Switch the three big accounts that unlock all the others first: Google, Apple and Microsoft. There the passkey is the default today, each account takes a few minutes, and the accounts hang on the email inbox through which everything else can be reset. After that come the services that offer passkeys – WhatsApp, payment services, shops; where the option is missing, it stays password plus second factor (→ Set up 2-Step Verification on your Google Account – prompts, app, key or passkey).

If you only use Apple or only Android devices, iCloud Keychain or Google Password Manager serves you well. If you mix – iPhone and Windows PC, Android and Mac – take a password manager that syncs passkeys and passwords across all platforms; according to our comparison, Bitwarden and Proton Pass do that for free as well. And for every account the rule is: always two ways in – a second passkey, a hardware key, backup codes or a strong password with a second factor (→ Create a strong password – and what is actually secure in 2026). The passkey makes signing in simpler and more secure; preparing for the loss of a device remains your job.