iOS Internals · iCloud & Your Apple Account · Lesson 1 of 5

Account Security & Passkeys

Guard the account behind your iPhone with 2FA, passkeys and security keys.

Two keys to one account

Your Apple Account is the sign-in you use for iCloud, the App Store, Find My, iMessage and FaceTime. For years Apple called it an Apple ID. With iOS 18 in 2024, Apple renamed it Apple Account. Your email address and password stayed the same, only the name changed, so older guides and older devices may still say Apple ID.

Because one account unlocks so much, Apple protects it with two-factor authentication (2FA). Signing in on a new device or on the web needs two things: your password, plus a six-digit verification code. Apple says 2FA is the default for most accounts, and services such as Apple Pay require it.

The code comes from one of two places:

• A trusted device, an iPhone, iPad or Mac that's already signed in to your account with 2FA. The code appears on its screen after you allow the sign-in, along with the approximate location of the new device.
• A trusted phone number, which gets the code by text message or phone call. Adding a second number you can reach, such as a family member's phone, helps if you ever lose yours.

Once you've signed in on a device, Apple usually won't ask for a code there again unless you sign out, erase the device or change your password.

Now the rule that matters most. The code is the second key. If a criminal already has your password, the code is the only thing still in their way, and they know it. A common trick is a call that seems to come from Apple Support, sometimes with Apple's real number spoofed on the caller ID. The caller says your account is under attack and asks you to read out the code that just appeared, to verify you or close a ticket. In fact they're signing in as you at that moment.

Apple says it never asks for your password, device passcode or two-factor code to provide support, and never asks you to turn off a security feature. If someone calls claiming to be Apple, hang up and contact Apple yourself through its official support channels. A sign-in request you didn't start means someone probably has your password, so change it.

Passkeys and security keys

Passwords have a weakness: they can be stolen. You might type one into a convincing fake website, or a company you use might get hacked. A passkey is a replacement for a password that avoids both problems, and iPhone has supported them since iOS 16.

When you create a passkey for a website or app, your device makes a matching pair of keys. The public key goes to the website. The private key stays with you, and Apple says the server never learns it. When you sign in, your iPhone proves it holds the private key and you approve with Face ID, Touch ID or your passcode. There's nothing to type, so a fake site has nothing to capture. Each passkey is also tied to the real website it was made for, so it won't work on a lookalike. That makes passkeys highly resistant to phishing, the trick of fooling you into handing over sign-in details.

Passkeys are saved in iCloud Keychain, so they sync to your other Apple devices. Apple says iCloud Keychain is end-to-end encrypted with keys it doesn't know. To sign in on a computer that isn't yours, pick the option to use a passkey from a nearby device, scan the QR code with your iPhone and approve with Face ID. Bluetooth has to be on, because the devices must really be close together.

For extra protection on the Apple Account itself, Apple added Security Keys for Apple Account in iOS 16.3. A security key is a small physical device, such as a USB or NFC key on your keyring. With the feature on, signing in on a new device needs your password plus the key or a nearby trusted Apple device, instead of a six-digit code. A caller can't talk you into reading out a piece of hardware.

It comes with rules. You must add at least two FIDO Certified keys, and up to six. Every device signed in to your account needs iOS 16.3, iPadOS 16.3 or macOS Ventura 13.2 or later, and child accounts aren't supported. Apple warns that losing all your trusted devices and security keys could lock you out of your account permanently, so store the spare somewhere safe.