A passkey is a way to sign in to a website or app without typing a password. You confirm with your face, fingerprint or device PIN, and a key stored on your device does the rest. There is nothing to remember and nothing for a fake login page to steal.
How a passkey works
A passkey is a pair of keys. The website keeps the public key. Your device keeps the private key, which never leaves it. When you sign in, the site sends a challenge, your device signs it with the private key after you confirm, and the site checks the answer against the public key.
Your device only offers the passkey to the real site it was created for, so a look-alike page gets nothing. A password is different: it is a secret you and the site both know, so anyone you trick into typing it has it too.
Passkey vs password
- Nothing to type or remember. You approve the sign-in on your device.
- Different for every site. A passkey made for one site does not work on another.
- Not reusable. There is no shared secret to leak in a site breach.
For the full comparison, including the downsides, read passkey vs password.
Where a passkey is stored
A passkey lives with a passkey provider: the one built into your phone, or a password manager you choose, such as DroidPass. When a site offers to create a passkey, your phone asks where to save it. Saving it in a password manager means it follows you to your other devices instead of staying on one phone.
How to create a passkey
- Sign in to a site that supports passkeys and open its security or sign-in settings.
- Choose to create a passkey (the wording varies by site).
- When your phone asks where to save it, choose your passkey provider.
- Confirm with your face, fingerprint or PIN. Next time, choose your account and confirm instead of typing a password.
Passkeys only work where a site or app has added support, and many have not yet, so you will still need passwords for the rest.
What happens if I lose my phone?
It depends on where the passkey is saved. A passkey stored only on one phone goes with it. One saved in a password manager that syncs can be restored on a new device. Keep another way to sign in to each important site, such as its password, until you are sure you can get back in.
Passkeys in DroidPass
DroidPass can be your passkey provider on Android and iPhone. Turn on passkeys in the app, then create a passkey on the website or app itself and choose DroidPass when your phone asks where to save it. It appears in your Passkeys list straight away, and you sign in from the AutoFill suggestion.
Turning passkeys on creates a Secret Key and an Emergency Kit PDF. You need that Secret Key, plus your Master PIN, to open your passkeys on another device. The free plan includes one passkey; Pro has unlimited passkeys. More in passkeys in DroidPass and on the passkeys feature page.
Frequently asked questions
What is a passkey in simple terms?
A passkey is a replacement for a password. A key stored on your device proves it is you, and you approve each sign-in with your face, fingerprint or PIN instead of typing anything.
Do I still need a password if I use a passkey?
Often yes, as a backup. Passkeys only work on sites and apps that support them, and it is wise to keep another way to sign in to important accounts until you are sure you can recover your passkeys.
Can a passkey be phished?
Your device only offers a passkey to the real site it was created for, so a fake login page cannot collect it. That is why passkeys are described as phishing-resistant.
How many passkeys can I save in DroidPass for free?
One. Pro removes the limit.