Windows Security · Accounts & Sign-In Security · Lesson 2 of 5

Passkeys on Windows

Sign in with your face, finger or PIN, with nothing for a fake site to steal.

What a passkey really is

A passkey is a way to sign in to a website or app without a password. It is a pair of matching digital keys that your device creates.

• The private key stays on your device. It never leaves.
• The public key is given to the website. It is useless on its own.

When you sign in, the site sends your device a puzzle. Your device solves it with the private key. The site checks the answer with the public key. No secret travels across the internet, so there is nothing to catch on the way. And a break-in at the website can't leak your passkey.

On Windows, Windows Hello guards your passkeys. You set up Hello earlier: your PIN, face or fingerprint. When a site asks for a passkey, Windows asks for Hello first. Your face and fingerprint data stay on your device. They are not sent to Microsoft or to the website.

Here is the big win. Each passkey is tied to the exact web address it was made for. A fake site, like micros0ft-login.example, is a different address. Your device has no passkey for it, so there is nothing to hand over.

Compare that to a password. You learned that phishing uses fake sign-in pages. A perfect copy of a page can collect your password, and even a code from a text. With a passkey you never type a secret, so you can't be tricked into typing it in the wrong place.

To make one, sign in to an account that offers passkeys, such as your Microsoft account. Look in its security settings for Passkeys, or for a way to add a new sign-in method. Windows asks for your Hello PIN, face or finger, and the passkey is saved.

Where your passkeys are kept

Where a passkey lives depends on where you saved it.

• A device-bound passkey stays on one device only, such as this PC. If the PC is lost or reset, that passkey is gone.
• A synced passkey is saved by a password manager and copied to your other devices. The one built into Microsoft Edge can do this. So can Google, Apple and apps like 1Password.

Synced passkeys are handy, because a lost laptop doesn't take them with it. Just guard the password manager itself with a strong sign-in and two-step verification.

To see passkeys saved in Windows, open Settings, then Accounts, then Passkeys. You can search the list and delete one you no longer use.

Your phone can hold passkeys too. To use one on a PC, choose the option to use a phone or another device. Windows shows a QR code. Scan it with your phone's camera, then unlock the phone with your face, finger or PIN.

The phone must be close to the PC, and Bluetooth is usually needed for that check. This stops someone far away from tricking you with a QR code.

A few safe habits:

• Keep a second way into each account, like the Authenticator app or a phone passkey.
• Only scan a passkey QR code that you made appear yourself, while signing in. Never scan one someone sends you.
• Before you sell or give away a PC, reset it, so its passkeys go with the reset.