Browsers & Accounts · Passwords, Passkeys & Two-Step · Lesson 2 of 5

Passkeys Everywhere

Use passkeys on any phone, browser or password manager, even on a borrowed computer.

One passkey, many devices

In the Windows track you set up a passkey, a way to sign in with your face, fingerprint or device PIN instead of a password. Behind the scenes, a passkey is a pair of matching digital keys. The website keeps the public half. Your device keeps the private half and never sends it anywhere.

Passkeys follow an open standard from the FIDO Alliance, a group of tech companies, including Apple, Google and Microsoft, that agreed on one way to do it. That's why passkeys work across phones, computers and browsers from different makers.

Where does a passkey live? Usually in a password manager, which can sync it, meaning keep a copy up to date on every device signed in to the same account:

• Apple: the Passwords app and iCloud Keychain sync passkeys across your iPhone, iPad and Mac.
• Google: Google Password Manager syncs them across Android phones and Chrome where you're signed in.
• Windows: Windows Hello can keep passkeys on the PC itself.
• Separate managers like 1Password, Bitwarden and Dashlane store and sync passkeys on many brands of device.

Why bother? Passwords can be guessed, reused or typed into a fake site. A passkey is made for one website and only works there. If a scam page copies your bank's look, your device simply won't offer the passkey. Experts call this phishing-resistant.

To add one, look for "Passkeys" or "Create a passkey" in an account's security settings. You can usually keep your password too, and use either.

One tip: choose one main place to save passkeys, so you always know where they are.

Signing in on someone else's computer

Say you're on a library computer or a friend's laptop. Your passkey is on your phone, not on that computer. You can still sign in, and nothing gets saved on the borrowed machine.

1. On the computer, go to the site and choose a passkey sign-in. Look for words like "Use a passkey", "Other options" or "Use a phone or tablet".
2. A QR code appears, a square barcode your phone's camera can read.
3. Scan it with your phone's camera.
4. Unlock with your face, fingerprint or PIN on the phone.
5. The computer is signed in.

Your phone and the computer use Bluetooth, a short-range wireless link, to check that they're near each other. So both need it turned on. This closeness check matters. A criminal far away can't get you to sign them in by sending you their QR code, because your phone isn't near their computer.

When you're done, sign out on the borrowed computer. If the browser offers to save anything, say no.

A few more things to know:

• If you lose your phone, synced passkeys are still on your other devices. They come back when you sign in on a new phone.
• A passkey stored on only one device, like a physical security key, is gone if that device is lost. Keep a backup way to sign in.
• Only scan a passkey QR code shown on the screen in front of you, on a site you opened yourself. Never scan one sent in a message asking you to "verify your account".