Begin with one account and test the process before expanding. There is no need to immediately delete passwords or change every security setting. Create a passkey on a personal device, confirm that it works and prepare a recovery route. The important change is what you rely on to sign in, as well as what you no longer type.
What replaces the password
A passkey uses a cryptographic key pair. The public part is registered with the service. The private part is protected by your device or passkey provider. During sign-in, the device proves it has the corresponding private key without sending that key to the website.
Think of a proof your device can produce and the service can check against the public key it holds. The service verifies proof of the private key instead of checking an entered password. Microsoft's explanation describes the device digitally signing a challenge from the service, which then verifies that signature.
A fingerprint, face scan or local unlock code authorizes use of the passkey. Your fingerprint does not become the website's new password, and the site does not receive a picture of it. FIDO Alliance, which develops the relevant standards, explains that biometric processing remains on the device. A PIN can also be used where the device and service support it.
The phrase "the key stays on the device" needs qualification. Some passkeys are tied to one device; others are encrypted and synchronized between devices through a supporting provider. In either case, the website you sign in to does not receive the private key. That storage distinction matters when you replace your phone.
How this differs from a password and text-message code
A person can type a normal password into an imitation website. A one-time code can also be handed to an attacker if the user is persuaded to enter it in the wrong place. A passkey is associated with the website or app for which it was created, and the browser or operating system handles that relationship during authentication.
This is why passkeys are described as phishing-resistant. The protection concerns authentication; it is not a guarantee against every scam. You can still encounter a fake delivery notice, a false payment demand or a request to install harmful software. The guide to recognizing scam text messages helps distinguish secure sign-in from trusting the contents of a message.
The number of visible steps is not the sole measure of security. Google explains that a passkey can bypass its second verification step because using it combines access to the device with the ability to unlock it. Not receiving a text after sign-in does not necessarily mean protection was disabled. The behavior depends on the service and account type.
Where passkeys work, and where they are stored
Google and Microsoft offer passkey sign-in for accounts, as documented in their support pages. Apple devices support passkeys for participating websites and apps, with synchronization through iCloud Keychain. Operating-system support does not mean every website you open already offers passkeys.
Separate two roles: the service holding your account and the provider storing its passkey. An account with one service can use a credential stored by your device's credential manager. Those names do not have to match. Read the save dialog rather than automatically accepting it.
Google Password Manager can synchronize supported passkeys across compatible devices using the same account. Apple describes end-to-end encrypted synchronization through iCloud Keychain. Windows also offers local storage through Windows Hello alongside options for synchronized managers. Do not assume a locally stored passkey will automatically arrive on your next computer.
A work or school account may have additional organizational rules. If the option is missing or differs from a friend's experience, check the account type and your organization's instructions. There is no need to change unrelated settings to force a process the administrator does not permit.
Start with email on a personal device
A practical starting point is the email account you use to manage other accounts, if it supports passkeys. This is a suggested order, not a technical requirement. Choose a time when you are not rushed, with a locked personal device and current recovery details available.
Open the service through its familiar app or address and go to security settings. Find the passkey creation option, confirm the selected account and read where the credential will be saved. Authorize creation using the device's unlock method. Menu wording varies; identify both the action and the storage destination.
After creation, check the account's passkey list and the entry in its storage provider. Try another sign-in using a trusted browser or device while preserving existing access until the test succeeds. If the option does not appear immediately, consult the service instructions rather than repeatedly deleting and recreating it.
Move on to other important accounts once you understand where the first passkey resides and how to use it. Enabling the feature everywhere at once is less useful if you cannot identify the storage location afterward. A list of services and their credential providers can help, without adding unlock codes or recovery secrets to that list.
Prepare a way back before losing the phone
Synchronization may make passkeys available on another device, but it depends on access to the credential provider and its recovery protections. Apple documents an iCloud Keychain recovery process. Google Password Manager uses protections such as its own PIN or an Android device's screen lock. Providers do not all use one identical recovery route.
Check which alternatives you have: another trusted device, a different sign-in method, recovery details or a physical security key where supported. Confirm that you can access the recovery email address and contact details. This matters particularly when every apparent backup depends on the same phone.
If the device is lost, use another trusted device or the official recovery process. Review connected devices and passkeys, then remove access associated with the missing device according to the service's instructions. You may need to manage both the website registration and the credential manager's stored copy. Do not delete your last working sign-in method before establishing an alternative.
Keep passwords and backups according to the account's setup
Creating a passkey does not necessarily delete the password. Google says adding one does not remove existing authentication and recovery factors. Check which methods remain active and what each requires, instead of assuming a convenient sign-in has made the account entirely passwordless.
While a password remains an accepted route, continue protecting it and retain the additional verification required for that route. If the service offers backup codes, keep them somewhere protected that remains accessible without the phone. Do not disable other protections merely to simplify the settings screen.
When replacing a device, test sign-in and recovery on the new one before removing the old one. That makes the move a process you can pause and correct, rather than a gamble after previous access has gone. The FIDO Alliance passkeys page explains the underlying standard and the different storage approaches.
Do not save a passkey on a shared computer
Google warns that someone who can unlock a device holding a passkey may be able to access the account even after it has been signed out in the browser. Do not create one on a public computer, a friend's machine or a device profile shared by several people. A personal device with a secure lock is part of the decision.
Some flows let a phone approve a computer sign-in through a QR code and nearby-device checks. Use that process when you initiated it and know which account and computer it concerns. A familiar icon is not a reason to approve an unexpected request.
A passkey reduces the need to type a secret that an imitation website could steal. Your practical responsibilities become clearer: protect the device, understand storage and check the recovery path. Start with one account, complete another successful sign-in and expand at a pace you can follow.
More articles in the Technology section.
