Account security · Practical guide

Passkeys, security keys and MFA: what to choose

Not all sign-in methods offer the same protection. Learn when to use a passkey, when a physical key makes sense and how to prepare account recovery.

Reviewed: 30 October 2026 · Official sources

Editorial illustration of a smartphone, cryptographic shield and physical security key — Concept illustration, not a screenshot from a real account.

A realistic-looking phishing page asks for your email password. A passkey helps avoid that trap: on supported websites, you approve sign-in with your device instead of typing a reusable secret. It is still important to understand where the passkey lives and how to recover your account.

What is a passkey?

A passkey uses public-key cryptography. The website stores a public key; your device, credential manager or physical authenticator keeps the private key. You unlock the authenticator with Face ID, fingerprint, a device PIN or Windows Hello, as supported.

Properly implemented passkeys are tied to the genuine website. You cannot simply type the private key into a convincing imitation. They resist common phishing and password-reuse attacks, but do not prevent every scam, session theft or malware infection. Apple explains passkey security.

Passwords, two-step codes and passkeys compared

Protection depends on each service's implementation and recovery options
Method	How it works	Main risk
Password	Enter a reusable secret	Phishing and reuse
Password + SMS	Enter a text message code	Codes can be phished; mobile-number attacks
Password + authenticator app	Enter a temporary code	Codes can still be relayed by scammers
Synced passkey	Approve with your device or credential manager	Protect the device and sync account
FIDO2 hardware security key	Use a compatible key and local verification	Prepare for loss or damage

Passkeys are phishing-resistant in a way that SMS and time-based one-time codes are not. An authenticator app is often preferable to SMS, but neither is a complete substitute for FIDO sign-in. FIDO Alliance's comparison.

Synced passkeys and hardware keys

Synced passkeys

Apple Passwords and iCloud Keychain, Google Password Manager and other compatible managers can make credentials available across trusted devices. Secure the sync account and its recovery mechanisms.

Device-bound or physical keys

A FIDO2 security key may connect by USB or NFC and require a PIN or touch. It can provide separation from synced credentials, but a backup is essential.

Not all hardware keys support the same features. Check FIDO2 support and your devices before buying one. Apple's optional Security Keys for Apple Account setup is separate from creating a passkey for another website.

Practical first steps: Google, iPhone and Microsoft

Google: visit Google Account passkey settings directly. Choose to create a passkey and unlock your personal device. Google says adding a passkey does not remove existing passwords or recovery methods.
iPhone: enable iCloud Keychain and Apple Account two-factor authentication. On a website or app supporting passkeys, choose to create one and approve with Face ID, Touch ID or passcode. On iOS 18 or later, find it in the Passwords app; on older versions check Settings → Passwords. Apple's instructions.
Microsoft: open your personal account's advanced security settings and add a sign-in or verification method. Available storage options may include Windows Hello, a phone, compatible credential manager or physical key. Work or school accounts can have different policies. Microsoft's guide.

Do you need to buy a security key?

Not necessarily. A passkey in a properly protected phone or credential manager is useful for many people. A separate FIDO2 hardware key may suit high-value accounts or users who need more isolation.

For its optional advanced hardware-key protection, Apple requires at least two FIDO-certified keys and compatible software. Losing every trusted device and key could permanently lock you out. Check Apple's requirements, including supported connectors and devices, before buying anything.

Plan account recovery first

Add a backup. Register another passkey, compatible device or spare hardware key where supported.
Protect the sync account. A synced manager's recovery options matter greatly.
Store recovery codes securely and separately where provided.
Check fallback methods. A password, SMS or other sign-in option may remain enabled after adding a passkey.
Know what to do if a device is lost. Use the provider's official recovery and credential-revocation instructions.

Test the new method before removing an existing one. Account recovery is part of your protection, not an afterthought.

Frequently asked questions

Does a website receive my fingerprint or face?

No. Biometric checks normally happen locally in the authenticator; the website receives a cryptographic response.

Is a passkey the same as two-factor authentication?

Not exactly. Passkeys with user verification can provide phishing-resistant multi-factor authentication within one sign-in flow. Password plus a code is a different type of MFA.

Can I sign in using my phone on another computer?

Compatible services may use a QR code and nearby-device Bluetooth verification. Check the real website address.

What happens if I lose the physical key?

A spare key or trusted device may help. Recovery varies by provider and high-security options can have strict limitations.

Should I delete all my passwords?

No. Migrate gradually and confirm both sign-in and recovery. Some services retain password login as a fallback.

Sources and editorial review

Reviewed on 30 October 2026. We explain published standards and documented instructions, not results from independent audits of Apple, Google or Microsoft. No affiliate links or hardware sponsorship. Settings may differ by device or account.

Continue with iPhone security basics, WhatsApp protection or the Security Center.

Back to the Security Center