How to set up a passkey and sign in without a password

A passkey lets you sign in with your device's screen lock — fingerprint, face or PIN — instead of a password. The difference from a password is that there is no secret text to remember or write down: the private key stays on your device and is never sent to the site, which only keeps the matching public key. As the FIDO Alliance describes it, each passkey is generated uniquely for one account and works only on the address it was registered for, so it cannot be handed over to a fake sign-in page.

The steps below cover creating a passkey on a Google, Apple and Microsoft account, using your phone as a key on another computer, and what to do if you lose a device. The menu names come from each company's own help pages; labels may change as the interfaces are updated.

1. Prepare the device: screen lock and keychain sync A passkey depends on your device's screen lock: without a PIN, pattern, fingerprint or face unlock, no passkey can be created. Update the operating system and browser on both your phone and computer. On Apple devices, iCloud Keychain and two-factor authentication must be turned on; Apple states both as requirements for passkeys. Check them under Settings → [your name] → iCloud → Passwords & Keychain and turn syncing on.
2. Create a passkey on your Google Account Open your Google Account in a browser, go to Security and under "How you sign in to Google" open "Passkeys and security keys"; the direct address is myaccount.google.com/signinoptions/passkeys. Select "Create a passkey", confirm on screen and unlock your device. The passkey is created for the device you are using at that moment. If you are already signed in to your Google Account on an Android phone, that phone's screen lock can already act as a passkey.
3. Create a passkey on your Apple device and find it in Passwords On Apple devices passkeys are not switched on from one central menu; you tap Continue when a supported site or app offers to save a passkey on its sign-in or account screen. For a new account, follow the on-screen instructions in the sign-up flow; for an existing account, sign in with your password first and then open the account settings screen. The passkeys you create are stored in the Passwords app on iPhone, listed under the same account as the password, and sync to your other Apple devices through iCloud Keychain.
4. Add a passkey to your Microsoft account Go to your advanced security page at account.live.com/proofs/manage. Choose "Add a new way to sign in or verify", then select "Face, Fingerprint, PIN, or Security Key" and follow the instructions on your device. When you are asked where to save it, select "Continue" or "Create" to accept the suggested location, or "Change" / "Save another way" for alternatives: a synced password manager, your iPhone, iPad or Android phone, a hardware security key, or locally on your Windows device with Windows Hello.
5. Use your phone as a key on another computer On a computer that has no passkey of yours, you can sign in with your phone. On Google, after entering your username choose "Try another way" → "Use your passkey", scan the QR code with your phone's camera, then tap "Use passkey to sign in" on the phone and confirm with fingerprint, face unlock or PIN. On a Mac the same flow is "Other Options" → "Passkey from nearby device" on the sign-in screen. As the FIDO Alliance explains, this method checks Bluetooth proximity between the phone and the computer, so Bluetooth must be on for both devices and the phone must be nearby.
6. Keep your key in at least two places Do not depend on a single device. If your passkeys live in a cloud-based credential manager (what FIDO calls "synced" passkeys), they appear automatically on every device where you sign in to the same provider, including a brand-new one. If that is not enough for you, create a separate passkey on a second device or add a hardware security key: on Google that is "Create a passkey" → "Use another device", and on Microsoft it is the security key option offered when you choose where to save. Device-bound passkeys never leave the device, giving the highest assurance, but they are gone if that device is.
7. Do not turn off your backup sign-in methods Setting up a passkey is not a reason to delete your password, switch off two-step verification, or leave your recovery email and phone number empty. You will still need a fallback for sites that do not support passkeys, for older browsers, and for the day you lose your device. Even with Google's "Skip password when possible" setting turned on, your account password still exists and is asked for when needed. On the Apple side, two-factor authentication is a prerequisite for passkeys and cannot be switched off. Keep your recovery codes somewhere offline.
8. Name your saved keys and remove a lost device Keep the list tidy so you know which key sits on which device. You can rename or remove keys on Google's "Passkeys and security keys" page and on Microsoft at account.live.com/proofs/manage (for work or school accounts, mysignins.microsoft.com/security-info). In Windows, keys saved to the computer are listed under Settings > Accounts > Passkeys; use the three-dot menu next to a key and choose "Delete passkey". If you lose your phone, sign in from another device you still have, remove that device's passkey and sign out of open sessions.
9. Sign out and test the passkey Test it as soon as you finish: sign out and sign back in using only the passkey. If you are prompted for fingerprint, face or PIN after entering your username, the key works. Try the backup route as well, signing in with your second device or with your phone via the QR code. If something goes wrong, your password is still there; delete that passkey and create it again.

⚠ This guide is general information. Yudum cannot be held responsible for the outcome of following it; for official procedures always rely on the institution's own statement. Steps and fees change over time.

🎯 Related content

How to Check If Your Email Was in a Data Breach with Have I Been Pwned Use the free Have I Been Pwned service to see whether your email address and password appear in known data breaches, and what to do if they do. How do you download and delete your data with Google Takeout? From photos to email, from location history to searches — what's in your account? Download it all, and have what you don't need deleted automatically. What should you do if your social media account is hacked? The first ten minutes are when getting the account back is easiest. In order: recovery, closing sessions, protecting linked accounts, warning the… Where do you report internet fraud? If you've lost money, the first hours are critical. Which incident goes to which institution, and which evidence you need to gather — in order. How do you turn on two-step verification? Keep your account out of reach even if your password is stolen: two-step verification is the single setting that, on its own, makes the biggest… How to spot a scam message A parcel, a bank, e-Devlet, a prize draw... Fake messages all use the same patterns. Once you have learned those patterns, you don't fall for them…