How to Set Up Passkeys on the Accounts That Matter Most

Passwords get phished, reused and leaked, and most people know it but feel stuck because changing every login sounds like a weekend project. You can set up passkeys on the handful of accounts that actually matter in about 30 minutes, and once they are in place, a fake login page has nothing to steal.

This guide walks through what a passkey is in plain terms, which accounts to do first, the exact steps on phones and computers, and the backup plan that keeps you from getting locked out.

What a passkey is, without the jargon

A passkey replaces your password with a pair of digital keys. One key stays locked on your device. The other sits with the website. When you sign in, the site sends a challenge, your device answers it after you confirm with your face, fingerprint or device PIN, and you are in. Nothing you type travels to the site, so there is nothing for a scammer to capture.

The important part is that a passkey is tied to the real website address. If you land on a lookalike site, your device simply will not offer the passkey. That one property defeats most phishing, which is why it is worth learning to spot a fake version of a site and then making the question mostly irrelevant.

Which accounts to set up passkeys on first

Do not try to convert everything. Start with the accounts that can reset other accounts or move money. In order:

1. Your main email. Google, Microsoft and Apple accounts all support passkeys. Whoever controls your email can reset almost everything else.
2. Your phone's cloud account. This holds your backups, photos and often your saved passwords.
3. Your password manager, if it supports passkey login.
4. Banking and payment apps that offer it, such as PayPal.
5. Social accounts with your real identity attached, such as LinkedIn, Facebook or Instagram.

Five accounts, roughly five minutes each. That covers most of the damage a stolen password can do.

Step by step setup on a phone or computer

The menus differ slightly between services, but the flow is nearly identical everywhere.

On an iPhone or Mac

1. Make sure iCloud Keychain is on: Settings, your name, iCloud, Passwords and Keychain.
2. Sign in to the account in Safari or the official app using your current password.
3. Open the security settings and look for "Passkeys" or "Create a passkey".
4. Confirm with Face ID or Touch ID. The passkey is saved and synced to your other Apple devices.

On Android or Windows

1. On Android, passkeys save to Google Password Manager by default. On Windows 11, they save to Windows Hello or to your browser profile.
2. Sign in normally, go to the account's security page and choose the passkey option.
3. Approve with your fingerprint, face or device PIN.
4. Sign out and sign back in once to confirm the passkey prompt appears.

That last test matters. About one in ten setups I help with turns out to have saved the passkey to the wrong profile or browser, and it is far better to find that out now than at an airport.

Where the common advice goes wrong

A lot of guides tell you to delete your password the moment you add a passkey. I would not, at least not yet. Many services still fall back to a password for account recovery, for older devices, or for signing in on a borrowed laptop. If you delete it or forget it, you can end up in a slow recovery process with a support team that has no idea who you are.

The better approach is to keep a long, unique password stored in your password manager, add the passkey alongside it, and keep two-step verification turned on. The passkey becomes your everyday front door. The password and second factor become the locked back door you rarely touch. Once a service lets you disable password sign-in entirely and offers solid recovery codes, then it is reasonable to switch the password off.

A backup plan so you never get locked out

Passkeys live on devices, so the real risk is losing a device. Cover yourself with three habits:

• Use a synced passkey store. iCloud Keychain, Google Password Manager and most major password managers sync passkeys across your devices with end to end encryption. A passkey saved only to one browser profile is fragile.
• Register a second device. Add a passkey from your laptop as well as your phone, or add a hardware security key. Keys from Yubico or Google cost about 25 to 55 dollars and work as a spare.
• Save recovery codes. Print them or store them in your password manager. Most services give 8 to 10 single use codes.

If your email ever does get taken over despite all this, follow the steps in our guide to recovering a hacked email account, starting with the recovery codes you saved.

What changes day to day after you set up passkeys

The first week feels slightly unfamiliar, then it becomes faster than typing. Signing in to email on your phone turns into a single glance at the screen. On a laptop, your browser shows a small prompt and you touch the fingerprint reader or enter your device PIN. In my own testing, a passkey sign-in takes about 3 seconds, compared with 15 to 25 seconds for a password plus a six digit code.

You will still see password boxes on sites that do not support passkeys yet. That is normal. Keep using your password manager for those, and check the security settings of your important accounts every few months, because support is being added steadily. Google, Microsoft, Apple, Amazon, PayPal, GitHub and most large retailers already offer it.

What passkeys do not protect against

Passkeys stop stolen passwords and fake login pages. They do not stop malware already running on your device, a thief who knows your phone PIN, or a data breach on the company's own servers. Keep your devices updated, use a PIN longer than four digits, and treat any breach notice as a prompt to check your other accounts. A passkey is a large upgrade, not a force field.

Frequently asked questions

Are passkeys safer than passwords?

Yes, for the attacks most people actually face. A passkey cannot be reused on another site, guessed, or typed into a phishing page. The main remaining risks are losing your devices without a backup or someone else getting into your phone with your PIN.

What happens to my passkeys if I lose my phone?

If your passkeys are synced through iCloud Keychain, Google Password Manager or a password manager, they reappear when you sign in on a new device. If they were saved only on the lost phone, you will need a second registered device, a security key or recovery codes to get back in.

Can I use passkeys on a shared or work computer?

Yes, without saving anything to that computer. Choose the option to use a phone or another device, scan the QR code with your phone and approve there. Your passkey never leaves your phone, and the shared computer keeps nothing.