How to Set Up Passkeys for Passwordless Sign-In

The Problem

Every password problem comes from the same root cause: a password is a shared secret. You know it, the website stores a version of it, and anything that intercepts it — a phishing page, a breached database, an infostealer reading your browser — can replay it.

A passkey removes the shared secret. Your device holds a private key that never leaves it; the website only ever stores the matching public key. Signing in means your device proves it holds the private key, unlocked by your face, fingerprint, or PIN.

The practical consequences:

Cannot be phished. A passkey is bound to the real domain. A convincing fake at micros0ft-login.com gets nothing, because the browser will not offer the passkey to a domain it does not match.
Cannot be leaked in a breach. The server holds a public key, which is useless on its own.
Cannot be reused. Every site gets a different key pair.

Windows 11, iOS, Android, macOS, and every major browser support them. Adoption is now wide enough to be worth doing for your important accounts.

Not sure whether your details are already out there? Check first: check if your email was in a data breach.

Before You Start

Set up Windows Hello on the PC — face, fingerprint, or PIN. That is what unlocks a passkey stored on the machine. If Hello is misbehaving, fix it first: Windows Hello not working or Windows Hello PIN not available.

Decide where your passkeys will live before you create any. This is the decision that matters most:

| Store | Works across devices | Best for | |---|---|---| | Windows Hello (this PC) | No — tied to this machine | A desktop you always use | | Phone (iCloud Keychain / Google Password Manager) | Yes, within that ecosystem | Most people | | Password manager (1Password, Bitwarden, Dashlane) | Yes, everywhere | Mixed Windows / Android / Apple households | | Hardware key (YubiKey) | Yes, physically | Highest security, no cloud sync |

A passkey stored only in Windows Hello disappears if the PC dies. That is fine as a second passkey; it is a bad choice as your only one.

The Fix: Step-by-Step

Step 1: Turn On Windows Hello

Windows + I → Accounts → Sign-in options.
Set up Facial recognition or Fingerprint if your hardware supports it, and always set a PIN.
Enable For improved security, only allow Windows Hello sign-in for Microsoft accounts.

The PIN is device-local — it never leaves the PC and is protected by the TPM, which is why it is safer than a password despite looking simpler.

Step 2: Choose and Prepare Your Passkey Store

If you chose a password manager, install its browser extension and enable passkey support in its settings. If you chose your phone, confirm iCloud Keychain (iPhone: Settings → your name → iCloud → Passwords and Keychain) or Google Password Manager (Android: Settings → Google → Autofill) is on and syncing.

Doing this before creating passkeys means they land in the right place from the start. Moving them later is not always possible.

Step 3: Create Your First Passkey on Your Microsoft Account

Start here because it protects the account that controls your PC.

Go to account.microsoft.com → Security → Advanced security options.
Add a new way to sign in or verify → Face, fingerprint, PIN, or security key.
Choose where to save it — this PC (Windows Hello), your phone, or your password manager.
Complete the prompt with your face, fingerprint, or PIN.

Then repeat, saving a second passkey to a different store. Two passkeys in two places is the whole backup strategy.

Step 4: Add Passkeys to Google, Apple, and Your Password Manager

Google: myaccount.google.com → Security → Passkeys and security keys → Create a passkey.
Apple: passkeys are created automatically when you sign in with an Apple device and iCloud Keychain enabled.
Password manager: enable passkey storage, then add one for the manager's own account if it supports it.

Step 5: Work Through Your Remaining Accounts

Priority order, highest value first:

Email (this is the master key to everything else).
Password manager.
Banking and payments — many now support passkeys.
Cloud storage.
Shopping accounts with saved cards.
Social media.

Most sites hide the option under Settings → Security → Passkeys or Sign-in methods. If a site does not offer passkeys yet, make sure it at least has two-factor authentication with an app rather than SMS.

Step 6: Set Up Cross-Device Sign-In

Signing into a site on a PC using a passkey held on your phone works over Bluetooth:

On the sign-in page, choose the passkey option.
Select Use a phone or tablet.
Scan the QR code with your phone's camera.
Approve with your phone's biometric.

Bluetooth must be on for both devices. This is deliberate — proximity is what stops a remote attacker triggering the prompt.

Step 7: Do Not Delete the Password Yet

A passkey is a sign-in method added alongside your password, not a replacement for it — until you explicitly remove the password, which most services do not yet allow.

Keep a strong, unique password on every account as the fallback, stored in your password manager: create strong, memorable passwords and use a password manager safely.

Where a service offers a genuine "passwordless account" mode — the Microsoft account does — enable it only once you have at least two passkeys in different places plus a recovery method.

Step 8: Test Losing Your Device, On Purpose

Before you rely on this, verify you can get back in:

Sign out of a test account completely.
Sign back in using each passkey you created, from each device.
Confirm your account recovery options are current: set up account recovery options.
Save recovery codes somewhere offline — printed, or in a safe.

An untested recovery path is not a recovery path.

What Not to Do

Do not create only one passkey stored only on one device. Losing that device locks you out of anything you made passwordless.
Do not store passkeys and their recovery codes in the same place. If a laptop holds both, the laptop is a single point of failure.
Do not approve a passkey prompt you did not trigger. A prompt appearing out of nowhere means someone is attempting to sign in as you right now.
Do not remove your phone number and email recovery immediately after adding a passkey. Keep one working fallback until you have used the passkey for a few weeks.

FAQ

What happens if I lose my phone with all my passkeys on it?

If passkeys were syncing to iCloud Keychain or Google Password Manager, they restore automatically on a replacement device once you sign back in. If they were stored only on the device with no sync, you use your other passkey or your password plus 2FA — which is exactly why Step 3 says create two.

Can passkeys be stolen by malware?

The private key is held in the TPM or secure element and cannot be exported by software, so a stolen file does not exist. Malware with full control of a device could try to trigger a sign-in while you approve it, which is why device hygiene still matters — but there is no credential to steal and replay.

Are passkeys better than an authenticator app?

Yes, in one important way: an authenticator code can still be phished, because you can be tricked into typing it into a fake site. A passkey is bound to the real domain and simply will not work on the fake one. Use passkeys where offered and app-based 2FA everywhere else.

Do passkeys work across Windows, Android, and iPhone?

Cross-device sign-in works everywhere via the QR-code and Bluetooth flow. Automatic syncing is ecosystem-bound — Apple passkeys sync among Apple devices, Google's among Android and Chrome. A cross-platform password manager is what gives you one set of passkeys everywhere.

Can I use a passkey to sign in to Windows itself?

Windows sign-in uses Windows Hello, which is the same underlying technology. Passkeys are used for websites and apps. Setting up Hello is the prerequisite for storing passkeys on the PC.

Should I delete my passwords once passkeys are working?

Not yet. Most services still need a password as a fallback and for account recovery. Keep unique, strong passwords in a password manager, and use passkeys as the everyday sign-in method.

Still Not Working?

If the passkey option is missing on a site, it does not support them yet — set up app-based 2FA instead. If Windows never offers to save a passkey, check that Windows Hello is fully configured and the TPM is present and enabled: enable TPM and Secure Boot.