How to Set Up Passkeys on Google, Apple, Microsoft, WhatsApp -

Quick answer: A passkey lets you sign in with your fingerprint, face or phone screen lock instead of a password, and it can’t be phished because it only works on the real website. To set one up, go to your account’s security settings (for Google, myaccount.google.com/signinoptions/passkeys), choose Create a passkey, and confirm with your fingerprint, face or screen lock. It takes under a minute per account.

Passwords get stolen in data breaches, guessed, reused and typed into fake login pages. Passkeys fix most of that. There’s no secret for you to remember or for a scammer to trick out of you, and you can’t accidentally hand one to a phishing site.

This guide explains how passkeys work in plain English, how to set them up on the accounts that matter most, and what to do if you lose your phone. It’s current as of October 2026.

What is a passkey, and why is it safer than a password?

When you create a passkey, your device makes a matching pair of digital keys. The public key goes to the website. The private key stays on your device or in your password manager, protected by your fingerprint, face scan or screen-lock PIN, and is never sent to the site. Apple’s security overview describes the same model: the server only ever holds the public key.

That design is why the FIDO Alliance, the industry group behind the standard, calls passkeys phishing-resistant. A fake banking site can copy a login page perfectly, but it can’t use a passkey made for the real site, and there’s no code you can be talked into reading out.

Your fingerprint or face data doesn’t leave your phone either. As Google’s help page puts it, your biometric data “stays on your device and is never shared with Google.”

Passkeys vs passwords vs OTPs: how they compare

Method	Can a fake site steal it?	Main weakness
Password only	Yes	Reused, leaked in breaches, easily phished
Password + SMS OTP	Yes, if you type or read out the code	SIM swaps and OTP-sharing scams
Password + authenticator app	Yes, if you type the code into a fake site	Real-time phishing
Passkey	No	Account recovery if you lose all your devices

Two-step verification is still far better than a password alone. But if a service offers passkeys, they’re the strongest everyday option.

How to set up a passkey for your Google account

Google supports passkeys on Windows 10 and later, macOS Ventura and later, ChromeOS 109 and later, Android 9 and later and iOS 16 and later, plus FIDO2 security keys, according to its help page. Your phone needs a screen lock turned on.

Go to myaccount.google.com/signinoptions/passkeys and sign in.
Click or tap Create a passkey.
Confirm with your fingerprint, face, PIN or pattern.

On Android and in Chrome, passkeys are saved in Google Password Manager. Since September 2024, Google has synced them across Windows, macOS, Linux and Android, protected by a Google Password Manager PIN. Google says that PIN keeps your passkeys end-to-end encrypted so they “can’t be accessed by anyone, not even Google,” according to Google’s announcement.

How to use passkeys on iPhone, iPad and Mac

On Apple devices, passkeys are stored in iCloud Keychain, which Apple says is end-to-end encrypted, and sync across your Apple devices. You manage them in the Passwords app on recent versions of iOS and macOS.

Make sure iCloud Keychain is on: open Settings, tap your name, then iCloud, then Passwords (or Passwords and Keychain).
Sign in to an app or website that supports passkeys, and look for an option such as Create a passkey in its security settings.
When your iPhone asks whether to save the passkey, confirm with Face ID or Touch ID.

Apple notes that any Apple account using iCloud Keychain must have two-factor authentication turned on, which is a sensible extra layer.

How to add a passkey to a Microsoft account

These steps are based on PCWorld’s walkthrough:

Go to account.microsoft.com/security and sign in.
Select Manage how I sign in.
Choose Add a new way to sign in or verify, then Face, fingerprint, PIN, or security key.
Follow the prompts from your browser and Windows. To save the passkey on your phone instead, scan the QR code with your phone’s camera.

How to set up a passkey on WhatsApp

On WhatsApp, a passkey replaces the SMS code when you log in again on your phone. Go to Settings, then Account, then Passkeys, and tap Create passkey, as described by Android Authority and TechRadar.

Keep WhatsApp’s separate two-step verification PIN switched on as well (Settings, Account, Two-step verification). Android Authority points out that a passkey alone doesn’t stop someone who has taken over your phone number from trying to register your account.

Other big services, including Amazon and PayPal, also support passkeys; look for “passkey” in each account’s login or security settings. Banks and UPI apps in India mostly still use PINs and OTPs, so treat those with extra care. Our guide to common online scams in India covers the tricks used to steal them.

What if you lose your phone?

Losing a device doesn’t lock you out if your passkeys are synced, because they’re also on your other signed-in devices. Still, a few precautions help:

Remove the lost device’s passkey. Google advises signing in on a device you can still use and deleting the passkey for the lost one from your account’s security settings.
Keep a backup sign-in method. Leave a recovery email, recovery phone number or backup codes on each important account.
Have more than one device. A laptop or tablet signed in to the same account acts as a spare key.
Block the phone in India. Use Sanchar Saathi to block a lost or stolen phone across networks.

For more account-security guides, see our Cybersecurity and Privacy section.

Frequently asked questions

Do passkeys replace my password completely?

Often not yet. Many accounts keep your password as a backup, so it’s still worth making it strong and unique. Over time, some services let you remove the password entirely once a passkey is set up.

Can I use a passkey on a computer that isn’t mine?

Yes. On a shared or new computer, choose to sign in with a passkey from another device, and scan the QR code with your phone. The FIDO Alliance calls this cross-device sign-in; your phone needs to be nearby.

Can someone use my passkey if they know my phone PIN?

Passkeys are protected by your device’s screen lock, so anyone who knows your phone PIN and has your phone could use them. Use a strong screen lock and don’t share it.

Are passkeys free?

Yes. They’re built into Android, iOS, macOS, Windows and major browsers, and you don’t need a special app. A physical security key is optional and costs extra.

How to Set Up Passkeys on Google, Apple, Microsoft, WhatsApp