Passkeys explained: what they are and why they're safer

Passwords have one deep flaw: you have to tell them to whoever asks. Type yours into a convincing fake sign-in page and the scammer has it. Reuse it on two sites and one leak opens both. Passkeys were designed to remove that flaw, and both iPhone and Android now support them for any website or app that offers them.

What a passkey actually is

When you create a passkey for an account, your phone makes a matched pair of keys. One half, the public key, goes to the website. The other half, the private key, stays in your phone’s password manager and never leaves it in readable form.

When you sign in later, the website sends a one-time challenge. Your phone asks you to approve with your screen lock, then signs the challenge with the private key. The site checks the signature with the public key it already holds. Nothing secret crosses the internet, so there’s nothing for anyone to steal in transit or from the site’s database.

Why passkeys stop phishing

Each passkey is tied to the exact website it was made for. If a scam message sends you to a lookalike address, your phone simply won’t offer the passkey there, because the address doesn’t match. With a password, you’d have no such protection: the fake page would happily accept what you typed.

That makes passkeys especially valuable for the accounts that matter most, like your email and the account that holds your photo backup. Taking over either of those usually starts with a stolen password.

Creating a passkey

Not every site supports passkeys yet. Where one does, the steps are similar on both phones:

1. Sign in to the website or app the usual way.
2. Look for a prompt to create a passkey, or find the option in the account’s security settings.
3. Confirm with your screen lock.

On Android, passkeys are saved to the password manager you choose. You can pick it in Settings, under Passwords, passkeys & accounts, or by searching Settings for “password”. On iPhone, passkeys are saved in the phone’s built-in password manager, next to any password you keep for the same account, and sync to your other devices signed in to the same account.

Signing in with one

Next time you visit the sign-in page, tap the account name field. Your phone suggests the saved account. Choose it and approve with your fingerprint, face or PIN. That’s the whole sign-in.

On a computer that isn’t yours, such as a library or a friend’s laptop, choose the option to sign in with a passkey from another device. The computer shows a QR code. Scan it with your phone’s camera, approve on the phone, and you’re signed in without typing anything on the borrowed computer.

What passkeys don’t fix

Passkeys are a real improvement, but they move the weak point rather than removing it entirely.

• Your screen lock becomes the key. Anyone who can unlock your phone can approve a passkey. A short or shared PIN undoes much of the benefit. See PIN, pattern, passphrase or biometrics.
• Your password manager account matters more. Synced passkeys live in that account. Protect it with a strong password and two-step verification, and check which devices are signed in to it. See checking devices signed in to your account.
• Fallbacks remain. Many sites still accept a password or a text code if the passkey isn’t available. A scammer will aim for the weakest option the site still offers.
• Recovery is still needed. If you keep a passkey on one device only and lose it, the site’s account recovery is your way back in.

Passkeys and passwords together

For now, most people will use both. A sensible approach:

• Add passkeys to your email, your phone’s main account and any account that holds photos or documents.
• Keep a password manager for sites without passkey support, and use long random passwords or passphrases there. The passphrase generator makes them in your browser.
• Turn on two-step verification wherever a password still works.

Where Silo fits

Passkeys protect accounts on the internet. Silo, coming soon to iPhone and Android, has no account at all, so there’s nothing to sign in to and nothing to phish. Its vault opens with its own PIN, or a passphrase on Pro, and the key to your files is made from that on the phone. If you forget it, the recovery phrase you write down at setup is the way back in.