# How to Set Up Passkeys for Passwordless Sign-In

URL: https://www.mytechnician.tech/tips/set-up-passkeys-passwordless-sign-in/
Published: 2026-08-07 | Author: Ankit Kumar
Tags: Windows 11, Security, Password, Online Safety
Summary: Passkeys cannot be phished, reused, or stolen in a breach. Set them up on Windows 11, your phone, and your main accounts — and keep a way back in if a device is lost.

## The Problem
Every password problem comes from the same root cause: a password is a shared secret. You know it, the website stores a version of it, and anything that intercepts it — a phishing page, a breached database, an infostealer reading your browser — can replay it.

A **passkey** removes the shared secret. Your device holds a private key that never leaves it; the website only ever stores the matching public key. Signing in means your device proves it holds the private key, unlocked by your face, fingerprint, or PIN.

The practical consequences:

* **Cannot be phished.** A passkey is bound to the real domain. A convincing fake at `micros0ft-login.com` gets nothing, because the browser will not offer the passkey to a domain it does not match.
* **Cannot be leaked in a breach.** The server holds a public key, which is useless on its own.
* **Cannot be reused.** Every site gets a different key pair.

Windows 11, iOS, Android, macOS, and every major browser support them. Adoption is now wide enough to be worth doing for your important accounts.

> **Not sure whether your details are already out there?** Check first: [check if your email was in a data breach](https://www.mytechnician.tech/tips/check-if-your-email-was-in-a-data-breach/).

## Before You Start
Set up **Windows Hello** on the PC — face, fingerprint, or PIN. That is what unlocks a passkey stored on the machine. If Hello is misbehaving, fix it first: [Windows Hello not working](https://www.mytechnician.tech/tips/fix-windows-hello-not-working/) or [Windows Hello PIN not available](https://www.mytechnician.tech/tips/fix-windows-hello-pin-not-available-windows-11/).

Decide **where your passkeys will live** before you create any. This is the decision that matters most:

| Store | Works across devices | Best for |
|---|---|---|
| Windows Hello (this PC) | No — tied to this machine | A desktop you always use |
| Phone (iCloud Keychain / Google Password Manager) | Yes, within that ecosystem | Most people |
| Password manager (1Password, Bitwarden, Dashlane) | Yes, everywhere | Mixed Windows / Android / Apple households |
| Hardware key (YubiKey) | Yes, physically | Highest security, no cloud sync |

A passkey stored only in Windows Hello disappears if the PC dies. That is fine as a *second* passkey; it is a bad choice as your only one.

## The Fix: Step-by-Step

### Step 1: Turn On Windows Hello
1. `Windows + I` → **Accounts** → **Sign-in options**.
2. Set up **Facial recognition** or **Fingerprint** if your hardware supports it, and always set a **PIN**.
3. Enable **For improved security, only allow Windows Hello sign-in for Microsoft accounts**.

The PIN is device-local — it never leaves the PC and is protected by the TPM, which is why it is safer than a password despite looking simpler.

### Step 2: Choose and Prepare Your Passkey Store
If you chose a password manager, install its browser extension and enable passkey support in its settings. If you chose your phone, confirm iCloud Keychain (iPhone: **Settings** → your name → **iCloud** → **Passwords and Keychain**) or Google Password Manager (Android: **Settings** → **Google** → **Autofill**) is on and syncing.

Doing this before creating passkeys means they land in the right place from the start. Moving them later is not always possible.

### Step 3: Create Your First Passkey on Your Microsoft Account
Start here because it protects the account that controls your PC.

1. Go to `account.microsoft.com` → **Security** → **Advanced security options**.
2. **Add a new way to sign in or verify** → **Face, fingerprint, PIN, or security key**.
3. Choose where to save it — this PC (Windows Hello), your phone, or your password manager.
4. Complete the prompt with your face, fingerprint, or PIN.

Then repeat, saving a **second** passkey to a different store. Two passkeys in two places is the whole backup strategy.

### Step 4: Add Passkeys to Google, Apple, and Your Password Manager
* **Google:** `myaccount.google.com` → **Security** → **Passkeys and security keys** → **Create a passkey**.
* **Apple:** passkeys are created automatically when you sign in with an Apple device and iCloud Keychain enabled.
* **Password manager:** enable passkey storage, then add one for the manager's own account if it supports it.

### Step 5: Work Through Your Remaining Accounts
Priority order, highest value first:

1. Email (this is the master key to everything else).
2. Password manager.
3. Banking and payments — many now support passkeys.
4. Cloud storage.
5. Shopping accounts with saved cards.
6. Social media.

Most sites hide the option under **Settings** → **Security** → **Passkeys** or **Sign-in methods**. If a site does not offer passkeys yet, make sure it at least has [two-factor authentication](https://www.mytechnician.tech/tips/set-up-two-factor-authentication-2fa/) with an app rather than SMS.

### Step 6: Set Up Cross-Device Sign-In
Signing into a site on a PC using a passkey held on your phone works over Bluetooth:

1. On the sign-in page, choose the passkey option.
2. Select **Use a phone or tablet**.
3. Scan the QR code with your phone's camera.
4. Approve with your phone's biometric.

Bluetooth must be on for both devices. This is deliberate — proximity is what stops a remote attacker triggering the prompt.

### Step 7: Do Not Delete the Password Yet
A passkey is a sign-in method added alongside your password, not a replacement for it — until you explicitly remove the password, which most services do not yet allow.

Keep a strong, unique password on every account as the fallback, stored in your password manager: [create strong, memorable passwords](https://www.mytechnician.tech/tips/create-strong-memorable-passwords/) and [use a password manager safely](https://www.mytechnician.tech/tips/use-a-password-manager-safely/).

Where a service offers a genuine "passwordless account" mode — the Microsoft account does — enable it only once you have at least two passkeys in different places plus a recovery method.

### Step 8: Test Losing Your Device, On Purpose
Before you rely on this, verify you can get back in:

1. Sign out of a test account completely.
2. Sign back in using each passkey you created, from each device.
3. Confirm your account recovery options are current: [set up account recovery options](https://www.mytechnician.tech/tips/set-up-account-recovery-options/).
4. Save recovery codes somewhere offline — printed, or in a safe.

An untested recovery path is not a recovery path.

## What Not to Do
* **Do not create only one passkey** stored only on one device. Losing that device locks you out of anything you made passwordless.
* **Do not store passkeys and their recovery codes in the same place.** If a laptop holds both, the laptop is a single point of failure.
* **Do not approve a passkey prompt you did not trigger.** A prompt appearing out of nowhere means someone is attempting to sign in as you right now.
* **Do not remove your phone number and email recovery** immediately after adding a passkey. Keep one working fallback until you have used the passkey for a few weeks.

## FAQ

### What happens if I lose my phone with all my passkeys on it?
If passkeys were syncing to iCloud Keychain or Google Password Manager, they restore automatically on a replacement device once you sign back in. If they were stored only on the device with no sync, you use your other passkey or your password plus 2FA — which is exactly why Step 3 says create two.

### Can passkeys be stolen by malware?
The private key is held in the TPM or secure element and cannot be exported by software, so a stolen file does not exist. Malware with full control of a device could try to trigger a sign-in while you approve it, which is why device hygiene still matters — but there is no credential to steal and replay.

### Are passkeys better than an authenticator app?
Yes, in one important way: an authenticator code can still be phished, because you can be tricked into typing it into a fake site. A passkey is bound to the real domain and simply will not work on the fake one. Use passkeys where offered and app-based 2FA everywhere else.

### Do passkeys work across Windows, Android, and iPhone?
Cross-device sign-in works everywhere via the QR-code and Bluetooth flow. Automatic *syncing* is ecosystem-bound — Apple passkeys sync among Apple devices, Google's among Android and Chrome. A cross-platform password manager is what gives you one set of passkeys everywhere.

### Can I use a passkey to sign in to Windows itself?
Windows sign-in uses Windows Hello, which is the same underlying technology. Passkeys are used for websites and apps. Setting up Hello is the prerequisite for storing passkeys on the PC.

### Should I delete my passwords once passkeys are working?
Not yet. Most services still need a password as a fallback and for account recovery. Keep unique, strong passwords in a password manager, and use passkeys as the everyday sign-in method.

## Still Not Working?
If the passkey option is missing on a site, it does not support them yet — set up app-based 2FA instead. If Windows never offers to save a passkey, check that Windows Hello is fully configured and the TPM is present and enabled: [enable TPM and Secure Boot](https://www.mytechnician.tech/tips/enable-tpm-secure-boot-windows-11-upgrade/).

Related: [set up two-factor authentication](https://www.mytechnician.tech/tips/set-up-two-factor-authentication-2fa/), [use a password manager safely](https://www.mytechnician.tech/tips/use-a-password-manager-safely/), [review and revoke app access and active sessions](https://www.mytechnician.tech/tips/review-revoke-app-access-active-sessions/).

---
Source: https://www.mytechnician.tech/tips/set-up-passkeys-passwordless-sign-in/ — My Technician, free Windows 10/11 troubleshooting guides.
More guides: https://www.mytechnician.tech/llms.txt