How to Set Up Passkeys on iPhone, Android, Windows and Mac

Key takeaways

• A passkey is a sign-in credential built on the FIDO2 and WebAuthn standards. It replaces a password with a cryptographic key pair, and you unlock it with your face, fingerprint, PIN or screen lock.
• You can set up passkeys on iPhone, Android, Windows and Mac in a few minutes. Google, Apple and Microsoft accounts all support them.
• Synced passkeys travel between your devices through a password manager such as iCloud Keychain, Google Password Manager or Microsoft Password Manager. Device-bound passkeys stay on one device or security key.
• Recovery planning matters more than setup: keep at least two ways to sign in, and know how your provider restores passkeys on a new device.
• A strong, unique password plus two-factor authentication (2FA) is still the fallback for sites that do not support passkeys yet.

How to set up passkeys: what a passkey actually is

This guide shows how to set up passkeys on iPhone, Android, Windows and Mac in a few minutes; Google, Apple and Microsoft accounts all support them. A passkey replaces your password with a cryptographic key pair, unlocked by your face, fingerprint, PIN or screen lock. Moving to a new phone? See how to set up iPhone Duo and transfer data.

The technical base is two standards. WebAuthn, maintained by the World Wide Web Consortium (W3C), is the browser API. Its Level 3 edition became a W3C Recommendation on 25 August 2026. CTAP is the protocol that lets a browser talk to an authenticator such as a phone or USB key. Together they are known as FIDO2.

The public-key model in plain English

When you create a passkey, your device generates two keys. The public key goes to the website. The private key stays with you, inside your device's secure hardware or your password manager's encrypted vault. Password managers are extending this to AI: 1Password for Agents lets AI agents sign in without seeing your password.

When you sign in, the site sends a random challenge. Your device signs it with the private key, but only after you unlock it with your face, fingerprint or PIN. The site checks the signature with the public key it already holds. No secret travels over the network, and the site never stores anything an attacker could reuse.

Two design choices make passkeys hard to phish. First, the W3C specification scopes every credential to a single "Relying Party", meaning the website or app it was created for. A passkey made for google.com will not answer a challenge from a look-alike domain. Second, a breach of the website's database exposes only public keys, which are useless for logging in. The FIDO Alliance notes that because there are no passwords to steal, password database breaches pose no threat to passkeys. Breaches keep happening: the Capcom data breach exposed 11.7 million CAPCOM ID records.

Synced versus device-bound passkeys

Passkeys come in two forms. Synced passkeys are copied across your devices through a passkey provider's cloud service. The FIDO Alliance says this syncing is end-to-end encrypted. Device-bound passkeys never leave one device, such as a hardware security key. The FIDO Alliance says device-bound passkeys on modern security keys offer the highest level of assurance, which is why some companies and high-risk users require them.

Requirements before you start

Most phones and computers sold in recent years can already store passkeys. The table below lists the minimum versions Google publishes for creating a Google Account passkey. It is a useful baseline for other services too.

Sources: Google Account Help; Google for Developers; Microsoft Support. Versions as published on 22 October 2026.

Before you begin, turn on a screen lock on your phone. On Apple devices, turn on iCloud Keychain. Apple requires two-factor authentication on any Apple Account that uses iCloud Keychain and will prompt you to set it up if it is off. To use a phone's passkey on a nearby computer, turn on Bluetooth as well.

How to set up a passkey for your Google Account

A Google Account passkey works on Android, iPhone, Windows, Mac and ChromeOS. According to Google's help page, the steps are:

1. Go to myaccount.google.com/signinoptions/passkeys and sign in, or verify your identity.
2. Tap Create a passkey, then unlock your device when prompted.
3. To put the passkey on a hardware security key instead, choose Use another device, insert the key, and enter its PIN or touch its sensor.
4. Repeat on each device you use regularly, unless your passkeys already sync between them.

Google advises creating passkeys only on devices you own and use personally, never on shared computers. By default, creating a passkey turns on Skip password when possible, so Google will stop asking for your password. You can switch that off under Security & sign-in if you prefer to type the password first. Google also notes that a passkey satisfies 2-Step Verification on its own, because it already proves you hold the device.

On Android, many phones store passkeys in Google Password Manager by default. On Android 14 or later, you can choose another password manager as your passkey provider in system settings. In Chrome on Windows, macOS, Linux and ChromeOS, passkeys saved to Google Password Manager sync across platforms. Google protects them with an end-to-end encrypted Password Manager PIN, which is six digits by default.

How to set up passkeys on iPhone and Mac

Apple has no single "create a passkey for your Apple Account" button for everyday use. Instead, iPhone, iPad and Mac act as passkey stores for any website or app that supports them. Apple's platform guide describes this process:

1. Open the sign-in screen of the website or app.
2. For a new account, choose the option to create one and follow the prompts. For an existing account, sign in with your password and open the account or security settings.
3. When the passkey option appears, tap Continue. Face ID or Touch ID confirms it.
4. The passkey is saved to the Passwords app and synced through iCloud Keychain to your other Apple devices.
5. To save it to a hardware security key, tap Other options or Save on another device if it appears.

If you do not see a passkey option, the site or app does not support passkeys yet. You can keep both a password and a passkey for the same account.

On iOS 18, iPadOS 18 and macOS Sequoia or later, the Passwords app manages passwords, passkeys and verification codes in one place. Apple says you can share passkeys with family or trusted contacts through a Shared Group, or send a single passkey by AirDrop. If you prefer Google Password Manager on iPhone, Google's developer documentation says iOS 17 or later lets you set Chrome as an autofill provider.

How to set up passkeys on Windows and for a Microsoft account

Windows stores passkeys through Windows Hello, which uses your face, fingerprint or PIN. Microsoft says Windows 10 and newer are supported, but you need Windows 11 for the latest passkey features. You also need Edge 109 or Chrome 109 or newer.

To add a passkey to a personal Microsoft account, Microsoft lists these steps:

1. On the device where you want the passkey, sign in to Advanced Security Options at account.live.com/proofs/manage.
2. Choose Add a new way to sign in or verify.
3. Select Face, Fingerprint, PIN, or Security Key.
4. Follow the on-screen prompts. Select Continue to save to the suggested location, or Save another way to choose a different one.
5. Confirm with your face, fingerprint or PIN.

Microsoft offers four save locations. You can use a synced password manager such as Microsoft Password Manager, Google Password Manager or iCloud Keychain. You can scan a QR code to save to a phone or tablet. You can use a physical security key, or save locally to the Windows device with Windows Hello. A passkey saved only on the PC is device-bound. If you lose that PC, you lose the passkey, so Microsoft recommends creating passkeys on more than one device. Work and school accounts are managed at mysignins.microsoft.com and only work if your organisation allows them.

Edge can also upgrade sites to passkeys automatically. You can turn that behaviour on or off under Settings, Passwords and autofill, Microsoft Password Manager, More settings, "Automatically upgrade to passkeys".

How to use a passkey from your phone on another computer

You do not need to create a passkey on every computer you touch. On a desktop sign-in page, choose an option such as Try another way or Use a different phone or tablet. The computer shows a QR code. Scan it with the phone that holds the passkey, then unlock the phone.

A proximity check over Bluetooth confirms that the phone is physically near the computer. This stops a remote attacker from relaying the request. Google, Apple and Microsoft all document this cross-device flow, and it works between ecosystems. An iPhone can sign you in on a Windows PC, for example.

How passkeys sync through password managers

Your choice of passkey provider decides where your passkeys go:

• iCloud Keychain / Passwords app: syncs across Apple devices with end-to-end encryption.
• Google Password Manager: syncs across Android and Chrome on Windows, macOS, Linux and ChromeOS. It is protected by the Password Manager PIN or your Android screen lock.
• Microsoft Password Manager: stores passwords and passkeys in Edge. Microsoft says this requires Edge 142 or newer and a personal profile.
• Third-party managers: Android 14+, iOS 17+ and Windows let you pick another provider for passkeys.

Moving passkeys between providers used to be difficult. The FIDO Alliance has since published the Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) for encrypted transfers between password managers. Its working group includes Apple, Google, Microsoft, 1Password, Bitwarden and Dashlane. Support is still rolling out unevenly, so check your manager's documentation before you switch.

What to do if you lose your phone or laptop

Recovery is the step most people skip. Here is how each ecosystem handles it, according to the vendors' own documentation:

• Apple: On a new device you need your Apple Account password and a six-digit verification code. If you lose every device, iCloud Keychain escrow can restore your passkeys after you verify with your iCloud credentials, an SMS code and a former device passcode. Apple allows only 10 attempts. After the tenth failure the escrow record is destroyed. An account recovery contact is an optional extra safeguard.
• Google: Sign in on a device you still have, open Security & sign-in, then Passkeys and security keys, and remove the passkey linked to the lost device. On a new device, your synced passkeys unlock with your Google Password Manager PIN or the screen lock of an old Android phone.
• Microsoft: A device-bound Windows Hello passkey cannot be recovered. You need another sign-in method or a second passkey.

A practical rule: register at least two independent sign-in methods for every important account. For example, a synced passkey plus a hardware security key, or a passkey plus a recovery code stored offline.

When a password plus 2FA still makes sense

Passkeys are not yet universal. Many banks, government portals and smaller sites still do not support them. On those sites, the next best option is a long, unique password from a password manager plus two-factor authentication, ideally an authenticator app or security key rather than SMS.

A password is also useful as a backup on accounts where you cannot afford to be locked out, and on shared or managed devices where you should not store a passkey. Some employers block passkey-only sign-in. Google notes that Workspace administrators may not allow it.

The security gap is large. FIDO Alliance materials attribute about 80% of breaches to passwords and cite Verizon data that 77% of hacking-related breaches involve stolen credentials. In a FIDO Alliance World Passkey Day 2025 study, 36% of people said they had had at least one account compromised because of a password. Recent incidents such as the State Bank of India cyberattack and the PHP emergency security patches show how quickly attackers move once a weakness appears.

What it means

For most people, setting up passkeys on their Google, Apple and Microsoft accounts is now the single most effective way to stop phishing. It takes less than ten minutes. Adoption is growing: in a 2024 survey commissioned by the FIDO Alliance, 53% of respondents had enabled passkeys on at least one account and 22% on every account they could. With WebAuthn Level 3 now a W3C Recommendation, expect more sites to offer passkeys by default. Phishing lures can be convincing: Madison Square Garden baited its own staff with free Knicks rings in a phishing test.

The trade-off is that your security now depends on your devices and your password manager. Protect the screen lock and the provider account, keep a second sign-in method, and know your recovery path before you need it.

If you are securing your setup more broadly, see our guides to running a local LLM with Ollama, which keeps prompts on your own machine, and building an MCP server in Python. For the risks of AI tools that act on your behalf, see our report on OpenAI agents and internal monitoring.

Sources

• FIDO Alliance — Passkeys: passwordless sign-in
• W3C — Web Authentication: An API for accessing Public Key Credentials, Level 3 (Recommendation, 25 August 2026)
• Google Account Help — Sign in with a passkey instead of a password
• Google for Developers — Passkey support on Android and Chrome
• Chrome for Developers — Chrome to sync passkeys on Google Password Manager between desktop and Android
• Apple Support — About the security of passkeys
• Apple Platform Deployment — Use passkeys in iPhone and iPad
• Apple Support — Use the Passwords app to manage and share passwords and passkeys
• Microsoft Support — Passkeys in Windows
• Microsoft Support — Create and save a passkey
• Bitwarden — Security vendors join forces to make passkeys more portable (CXP/CXF)