What is RealBytes - Digital Transformation Experts - TSP?

RealBytes - Digital Transformation Experts - TSP manages 5 data types including blog posts.

A passkey is a unique digital key that replaces your password. Creating one makes two linked keys: one stays in your credential manager, the other goes to the website. When you sign in, your device checks your face, fingerprint or PIN, then uses its key to prove it is you. Your private key is never shared.

How is a passkey different from a password?

A password is a secret you remember and type. A passkey is a key stored in your credential manager that you never see or type. Each passkey belongs to one website or app, so it cannot be guessed, phished or reused on other accounts the way a password can.

How is a passkey different from 2FA codes or authenticator apps?

Two-factor authentication usually adds a code after your password. A passkey can replace both the password and the code, because it proves you hold the key and confirms it is you with your face, fingerprint or PIN. Some sites still ask for extra verification depending on how they have set passkeys up.

What is FIDO2 and how does it relate to passkeys?

FIDO2 is the open technical standard passkeys are built on. "Passkey" is the friendly name for what FIDO2 makes possible. It is the reason passkeys work the same way across operating systems, browsers, apps, devices and credential managers from different companies.

Is a passkey the same as a security key like a YubiKey?

Not quite. A physical security key can store passkeys, but you do not need one. Most people keep passkeys in the credential manager on their phone or computer. Security keys are an extra option, and many businesses use them for admin accounts and shared workstations.

Does the website get my fingerprint or face scan?

No. Your device uses your fingerprint or face to confirm it is you, locally. Your biometric data never leaves the device and is never shared with the website or app.

How is my device PIN different from a password?

A password is sent to the website every time you sign in. Your device PIN is only checked on the device itself to unlock your passkey. It is never sent to the website or app.

Do Apple, Google or Microsoft own my passkeys?

No. Passkeys belong to you and are tied to the website, not the platform. Those companies simply store and sync them, like photos. If you lose access to that account, though, you may lose access to its passkeys on a new device, so pick a credential manager you trust.

How do I set up a passkey?

When a site or app offers passkeys, look for "Create a passkey" or "Set up a passkey" in your account or security settings. Your device asks for your face, fingerprint or PIN, then saves the passkey to your credential manager. Some sites prompt you straight after you sign in.

Why did a site still ask for my password after I set up a passkey?

Usually you are on a new device or browser that does not have your passkey yet. Once the passkey is available there, the password prompt should stop. It is an inconsistency in how some sites are rolling passkeys out, not a fault with your passkey.

Can I use only a passkey, with no password at all?

That is how passkeys are designed to work, but some sites still make you keep a password as a backup recovery method. Where a site lets you remove the password, make sure you have another reliable way to recover the account first.

Should I name my passkeys?

Yes, where the site allows it. Because most passkeys sync across all your devices, naming them after the credential manager (for example Bitwarden or Apple Passwords) is clearer than naming them after a single device.

Can I use a passkey on a computer that is not mine?

Often, yes. Choose an option like "Use another device" at sign-in. You will usually see a QR code to scan with your phone, which completes the sign-in without saving your passkey on that computer.

Do passkeys work across Apple and Windows?

Yes, but not always smoothly. A passkey in Apple Passwords will not necessarily sync to a Windows PC, so you may need to scan a QR code with your iPhone. If you use several ecosystems, a cross-platform credential manager makes life much easier.

What happens if I lose my phone?

It depends on your credential manager. Synced passkeys come back when you sign in to your credential manager on a new device. Passkeys stored on only the lost device are gone, so you would use each site's account recovery process. Check your recovery options before you need them.

Will changing phone carrier or number affect my passkeys?

No. Passkeys are tied to your credential manager or device, not your phone number. Just make sure your new phone has access to your credential manager before you trade in the old one.

Should I set up more than one passkey per account?

If your passkeys sync, one is generally enough. If a passkey lives on a single device or security key, register a second one as a backup. For business admin accounts we recommend two hardware keys per person.

Can I move passkeys to a different credential manager?

Increasingly, yes. Moving passkeys uses the FIDO Credential Exchange standard, and support depends on both managers. Check the credential exchange column in the scorecard above before you commit to one.

Are passkeys more secure than passwords and SMS codes?

Yes. Passkeys are designed to resist phishing and the common attacks that steal passwords and one-time codes. Each passkey is unique to one site, so it cannot be guessed, reused elsewhere or tricked into working on a fake website.

If someone steals my phone, can they get into my accounts?

Only if they can also unlock the phone with your face, fingerprint or PIN, because that check is needed to use any passkey on it. That is far harder for a remote attacker than stealing a password.

What if my credential manager provider is hacked?

Websites only hold public keys, so there is no password-style secret to steal and replay. Your passkeys are protected by your credential manager's encryption and the security of your devices, which is why choosing a well-rated manager matters.

What cryptography do passkeys use?

Public-key cryptography, most commonly ECDSA on the P-256 curve (COSE algorithm -7) per the WebAuthn specification. Some authenticators also support RS256 or EdDSA. The authenticator signs a server challenge with the private key, and the server verifies it with the stored public key.

Am I locked into one credential manager?

Not by design. Most popular managers now support secure migration of passkeys to another service, and credential exchange support is expanding across the industry. Where a move is not yet possible, it is a feature gap, not a limit of passkeys themselves.

Will passkeys be replaced by something else soon?

Unlikely. Passkeys are built on the FIDO2 open standard, backed jointly by Apple, Google and Microsoft, and are the long-term direction for sign-in. Setting them up now reduces your risk today, and the core experience of unlocking your device to sign in is expected to stay the same.

What Are Passkeys? Plain-English Guide for Australian Business

A passkey is a digital key that replaces your password

Passkeys let you sign in quickly and securely without creating, remembering or typing a password. Before a passkey is used, your device checks it is really you with your face, fingerprint or PIN.

Private key

Stays on your devices

Held in your credential manager. Never shared with anyone.

Linked

Public key

Stored by the website

Useless on its own. It can only check a signature, never create one.

Your half stays with you

The private key lives in your credential manager on your own devices. It is never handed to the website.

The website holds the matching half

The site stores a public key. On its own it cannot sign anyone in, so there is nothing worth stealing.

Together they prove it is you

At sign-in your device uses its half to prove who you are. No password is typed, sent or stored.

Technical detailAsymmetric cryptography

Passkeys use public-key cryptography, much like SSH keys. The private key is generated inside a credential manager or a hardware authenticator's secure element. The public key, plus some WebAuthn metadata, is sent to the server. Without the private key to sign challenges, the public key is mathematically useless, so the server never holds anything secret.

Passkeys on MDN

Signing in takes a few seconds

1
Create a passkey
Your credential manager makes a unique key pair for that website or app. The public half goes to the service. The private half stays in your credential manager and never leaves it.
2
Confirm it is you
Next time you sign in, your device asks for your face, fingerprint or device PIN. That check happens on the device. Your biometric is never sent anywhere.
3
You are in
Your device proves your identity to the website in a second or two, without any password crossing the internet.

Every passkey is unique

Each service gets its own passkey. The one you make for your bank only works with your bank, and the one for your email only works with your email. Because a passkey belongs to a single service, there is nothing an attacker can lift from one site and replay somewhere else.

It is also better for privacy. Each service only ever sees its own passkey, so there is no shared identifier that could be used to track you across sites.

Technical detailThe cryptographic handshake

During sign-in the service sends a challenge. The authenticator signs it with the passkey's private key, and the response also carries context such as the origin and whether the request came from an embedded frame. The server checks three things: the origin is the one it expects (bank.com.au, not fake-bank.com), the challenge matches the one it issued, and the signature is valid for the stored public key. That signed origin check is the main reason passkeys resist phishing.

Sign-in flow on MDN

Why passwords keep failing

Passwords are decades old and were never built for today's internet. We have bolted on text codes, email links and extra steps to shore them up. Those help in places, but they do not fix the core issue: a password is a poor way to prove who you are.

They get reused

One password across several accounts means one breach opens all of them. Attackers routinely try leaked passwords on other sites.

They get stolen from servers

Websites keep password data that attackers target in breaches. Once stolen, those passwords can be cracked and used.

They get phished

Fake login pages that look like the real thing trick people into handing over passwords, and even their one-time codes.

They slow everyone down

Remembering, resetting, waiting for texts and digging through email for codes adds friction to something staff do all day.

Passkeys were designed to fix all four.

Technical detailThe root problem

Passwords are shared secrets. You know it and the server stores it, which gives attackers two places to steal it: from you through phishing, and from the server through a breach. Every scheme built on shared secrets carries that weakness.

Verizon Data Breach Investigations Report

A lookalike site gets nothing from a passkey

Criminals build copies of real websites, such as your bank, email or a favourite shop, and lure you in to type your password. They then use it on the real site as you. Phishing is the most common route to stolen accounts, and it works against passwords, verification codes and text messages alike. A passkey is permanently tied to the exact site where you created it, so it will not respond on a typosquat or a redirect. Try it below.

Address bar

https://bank-secure-login.com

Passkey refuses to respond. There is nothing to type, so nothing to steal.

Technical detailWhy traditional MFA is not enough

Adversary-in-the-middle phishing kits relay SMS codes, authenticator codes and even push approvals to the real site in real time. FIDO2 and WebAuthn were designed to close that gap: credentials are scoped to a domain.

At registration the domain is recorded as the Relying Party ID (RP ID), which the browser or OS uses to pick the right passkey. The real protection, though, is that the calling origin is signed with the private key. The service checks that origin on its backend and rejects anything unexpected, so no session is created. For native apps the origin can be an app identity rather than a web address.

What is an origin? (MDN)Verifying an assertion (W3C)

Passkeys beat passwords, SMS codes and email links

Criteria	Password	Password + SMS code	Email login link	Passkey
Needs a password?	Yes	Yes	No	No
Can be phished?	Yes	Yes	Partially	No
Can be stolen from a server?	Yes (hash)	Yes (hash)	Partially	No
Open to replay attacks?	Yes	Partially	Partially	No
Ease of use	Hard to remember	Annoying	Needs email access	A glance or a touch

Technical detailCredential stuffing and server breaches

Credential stuffing takes username and password pairs leaked from one site and tries them everywhere else. Passkeys remove that attack completely because there is no reusable secret. Even a fully compromised server only gives up a list of public keys, which cannot be used to sign in. The private keys never left users' credential managers.

Passkeys live in a credential manager

A credential manager is an app or service that stores your passkeys and syncs them securely across your devices, the same way your photos or contacts follow you. Most people already have one: Google Password Manager or Samsung Wallet on Android, Apple Passwords on iPhone and Mac, Microsoft Password Manager on Windows and Edge. Independent options include 1Password, Bitwarden, Dashlane, Keeper, NordPass, Proton Pass, LastPass and KeePassXC. Create a passkey once and it is ready on every device you sign in to.

Passkeys are built on open standards, so any site that supports them works with any credential manager. The managers still differ on security, platform coverage and whether you can take your passkeys with you. Here is how they compare.

Credential manager	Grade	Ecosystem	Platform integration	Vault security	Credential exchange	Interoperability	Digital inheritance	Family sharing
1PasswordIndependent. All major platforms.	A · 91	Excellent	Excellent	Excellent	Excellent	Partial	Partial	Excellent
BitwardenOpen source. Free and self-hosted versions.	A · 86	Excellent	Partial	Excellent	Excellent	Partial	Excellent	Excellent
DashlaneIndependent. All major platforms.	B · 80	Excellent	Partial	Excellent	Excellent	Partial	Partial	Limited
NordPassFrom Nord Security.	B · 78	Excellent	Partial	Excellent	Partial	Partial	Excellent	Excellent
KeeperFor individuals and businesses.	B · 78	Excellent	Partial	Excellent	Partial	Partial	Excellent	Excellent
Apple PasswordsBuilt into iPhone, iPad and Mac. Syncs via iCloud Keychain.	B · 74	Limited	Partial	Excellent	Excellent	Excellent	Limited	Excellent
Proton PassEnd-to-end encrypted, from Proton.	B · 71	Excellent	Partial	Excellent	Limited	Partial	Excellent	Excellent
KeePassXCOpen source, offline-first. You manage sync of the database file.	C · 67	Excellent	Partial	Partial	Partial	Partial	Partial	Partial
Google Password ManagerBuilt into Android and Chrome. Syncs via your Google account.	C · 63	Limited	Partial	Partial	Excellent	Excellent	Limited	Limited
LastPassIndependent. All major platforms.	C · 56	Excellent	Partial	Partial	Limited	Partial	Limited	Limited
Microsoft Password ManagerBuilt into Edge and Windows. Syncs via your Microsoft account.	D · 49	Partial	Partial	Partial	Limited	Partial	Limited	Limited
Samsung Wallet (Pass)Built into Galaxy devices. Syncs across Samsung devices only.	D · 49	Limited	Partial	Excellent	Limited	Partial	Limited	Limited

Ecosystem: Native apps on Android, iOS, macOS and Windows, plus browser extensions elsewhere.
Platform integration: Works through the operating system, not just a browser extension.
Vault security: End-to-end, zero-knowledge encryption, including sensitive metadata.
Credential exchange: Can move passkeys and passwords to another manager using the FIDO standard.
Interoperability: Adheres to the latest WebAuthn Level 3 specification.
Digital inheritance: Built-in emergency or legacy access for a trusted person. Lower weight.
Family sharing: Secure sharing of passkeys, not just passwords. Lower weight.

Scores out of 100 by whatarepasskeys.info, last updated 22 September 2026, combining hands-on testing with vendor documentation. Real Bytes has not independently tested these scores.

Technical detailSynced vs device-bound passkeys

Most devices ship with a credential manager that creates synced passkeys. The private key is encrypted and synced end to end, so the vendor cannot decrypt or use it. Device-bound passkeys live on one device only. They are more resistant to a cloud or account compromise, but if you lose the device you lose the passkey. They need extra software or hardware, such as a FIDO2 security key or Windows Hello.

Synced passkeys (passkeys.dev)Device-bound passkeys (passkeys.dev)

Start saying goodbye to passwords

Look for the passkey option on the sites and apps you already use. It usually appears as a "Create a passkey" button in security settings, a "Sign in with a passkey" button on the login page, an autofill suggestion in the username field on desktop, or a keyboard suggestion on mobile. If your passkey is on your phone, choose "Use a passkey from another device" and scan the QR code. Setup takes seconds, and after that you spend less time signing in.

Passkeys at work come with tighter rules

A passkey works the same way at work as at home, but the rules around it are usually tighter. One compromised work account can put the whole business at risk, so employers often add controls you will not see on your personal accounts.

IT may choose the credential manager

At home you pick. At work, your IT or security team may require a specific credential manager, a managed device or a physical security key so every staff member meets the same bar.

Extra checks on sensitive systems

Finance, HR and admin consoles may need a PIN, a biometric or a managed device before a passkey is accepted.

The sign-in screen may look different

You might be asked to insert a security key, see company branding, or find your personal phone's passkey option is not offered at all.

Personal passkeys

You choose the credential manager
Usually synced through your personal cloud account
Built for convenience across your own devices

Work passkeys

May require a security key or managed device
Often device-bound, with no personal cloud sync
Governed by company security and compliance policy

Running Microsoft 365? Entra ID is making passkeys the default and retiring its built-in SMS and voice codes. See our Entra passkey transition guide for the dates, and our passwordless rollout guide for hardware keys, Windows Hello and recovery planning

Technical detailEnterprise controls behind the scenes

Organisations that need hardware-backed, attested, device-bound passkeys have to supply an authenticator or credential manager that meets that bar, such as hardware security keys or a work-focused credential manager with policy controls.

It is like file storage or AI tools: if you do not want staff choosing their own, you provide and require an approved option. Managed credential managers that support device-bound passkeys can enforce your requirements without full device management, because enforcement happens in the credential manager rather than the operating system.

Common questions about passkeys

The basics

Setting up and everyday use

Devices, syncing and recovery

Security

Trust and the future

Sources and attribution

This guide adapts content and credential manager scores from whatarepasskeys.info by the passkey community, used under CC BY 4.0. The text has been rewritten and changed for an Australian business audience.

Moving your business to passkeys?

We plan and deploy passkeys, hardware security keys and phishing-resistant MFA across Microsoft 365 and Google Workspace, including staff onboarding and recovery planning.

Talk to our identity team Passwordless rollout guide

What is a passkey?