Question 1

Why are passkeys more secure than passwords?

Accepted Answer

With passwords (and even with 2 step verification using things like codes in apps or by SMS and email) attackers can trick you into logging into their fake sites. Passkeys are specifically designed so this can't happen - however convincing the site is!

Question 2

How do passkeys prevent phishing?

Accepted Answer

Passkeys aren't something you need to remember. They use your devices (phone, tablet, laptop) to login, and they will only ever log in to the real website or app.

Question 3

How does your device log you in with a passkey?

Accepted Answer

Your device creates and stores a complex secret (too long for a human to remember), and something that pairs with it that it can give to the website you want to start logging into. When you try to log in, the website sends your device a challenge based on what it has that can only be responded to by the secret your device has. Your device also checks its really you before responding. Your device knows which secrets are for which websites, so it can't be tricked.

Question 4

How does passkey cryptography work?

Accepted Answer

Passkeys use something called public-key cryptography, a branch of mathematics that underpins all secure communication on the internet. When you create a passkey, your device is creating whats called public and private "keys", which are very very large numbers. The website stores the public key and knows which user account it is for, whilst your device stores the private key and knows which website its for. When you log in, the website sends a numerical challenge which your device uses the private key to calculate a response for and sends it back to the website. The website is able to use the stored public key to prove the challenge could only have been responded to if your device has the right private key.

Question 5

Could a quantum computer break passkeys?

Accepted Answer

If an advanced enough quantum computer can be built, it should be able to crack existing public key cryptography, which might let an attacker with such a quantum computer log into your account. However, passkeys have been designed so that when new algorithms are agreed that are safe against quantum computers, passkeys can be easily updated, without you even knowing it's happened.

Question 6

How does your device check it's really you?

Accepted Answer

Before approving a log in with a passkey, your device checks that its you. It does this by however you normally log into the device: fingerprint, facial recognition, passcode etc.

Question 7

Do websites get my fingerprint or face data with passkeys?

Accepted Answer

Your device verifies you using its normal way of you unlocking the device - it doesn't send any data like fingerprints or a picture to the website or app you're logging into. It just says that it verified you

Question 8

I'm happy with passwords — why switch to passkeys?

Accepted Answer

You might be happy with passwords, but so are attackers! Attackers are really good at either finding where you reuse a password, or tricking people into logging into a fake site. Passkeys stop that and are easier to use than passwords.

Question 9

Why are passkeys easier to use than passwords?

Accepted Answer

Passkeys have been created by a lot of the big tech companies working together, to make them easier for people than passwords are. At the moment when you log in, you need a password, then you probably need to wait for a code by text message, email, or have an app generate a code. Passkeys you just need to let your device quickly check it's you then you're logged in! Microsoft found it takes 8 seconds to log in with a passkey but over A MINUTE with password and a code.

Question 10

What happens to my passkeys if I lose my device?

Accepted Answer

Your passkeys might be stored on your device, but they will also be made available to your other devices by the same vendor. If you have an iPhone, your passkeys will be available on your other apple products like a MacBook or iPad. If you have an Android phone, then it should be available in Chrome browsers or an Android tablet. You can choose to use a password manager (known as a credential manager) by a company who don't make your device. If you do, your passkeys will be available anywhere you are logged into it. If you only have one device, then you just need to get back into the main account (Apple iCloud, Google Account, or the credential manager) and you'll have all your passkeys back.

Explore passkeys and how they work

Content issue