Passwords have been part of using the internet for so long that replacing them can initially sound more complicated than simply remembering another combination of letters, numbers and symbols.
In practice, passkeys are designed to make authentication simpler. Instead of typing a password, you approve the login using the same method you already use to unlock your phone or laptop: a fingerprint, face recognition or device PIN. Behind that familiar gesture, the device handles the cryptographic credential needed to prove that you are allowed to access the account.
For Techrow.gr, the useful question is not whether passwordless authentication is the future. It is much more practical: where is a passkey actually stored, how does it follow you between devices and what happens when the phone containing it is no longer available?
What Exactly Is a Passkey?
A passkey is a digital credential designed to replace a traditional password. It uses public-key cryptography rather than a shared secret that both the user and the website depend on.
When a passkey is created, the service receives a public key while the corresponding private credential remains protected by the user’s device or passkey provider. During login, the device proves that it possesses the correct credential without sending the private key to the website.
For the user, almost none of this complexity is visible.
You open the website or app, choose the account and confirm with Face ID, Touch ID, a fingerprint sensor or PIN. The operating system handles the rest.
That is why passkeys can feel much simpler than the technology underneath them.
Your Fingerprint Is Not the Passkey
One of the most common misunderstandings is that the fingerprint or face scan itself becomes the credential.
It does not.
Biometrics simply unlock access to the passkey stored or managed by the device. Google explicitly states that fingerprint and face data remain on the device and are not shared with Google during passkey authentication. Apple uses the same principle with Face ID and Touch ID.
The distinction is important.
The website does not receive a copy of your fingerprint. It receives cryptographic proof that the authorised credential was successfully used after the device verified its user.
Your face or fingerprint therefore functions more like the key that unlocks the key.
Where Is a Passkey Stored?
The answer depends on how it was created.
A passkey can be stored in a synced credential manager, locally on a particular device or on a physical FIDO2 security key. FIDO describes the first category as synced passkeys and credentials that remain on one authenticator as device-bound passkeys.
On Apple devices, passkeys can be stored through iCloud Keychain and made available across devices signed into the same Apple Account. Google Password Manager provides a similar role across supported devices, while Microsoft is rolling out synced passkey support through Microsoft Password Manager. Third-party password managers can also act as passkey providers.
This is one of the biggest differences from the early idea of hardware-based passwordless authentication.
A passkey does not necessarily belong permanently to one physical phone.
Depending on the provider, it can follow the user.
What Happens on an iPhone?
On an iPhone, supported websites and apps can create passkeys that are saved to iCloud Keychain. Apple requires iCloud Keychain and two-factor authentication for this functionality. Once stored, the passkey can become available on other Apple devices connected to the same Apple Account.
The actual login is straightforward. A supported service suggests the relevant account and the user confirms through Face ID, Touch ID or the iPhone passcode.
The important part is that there is no password hidden behind this process that the user needs to retrieve later.
The passkey itself performs the authentication.
This also means that someone who can unlock a device containing a passkey may potentially be able to use that credential, which is why passkeys should only be created on devices the user trusts and controls. Google makes the same warning in its own passkey documentation.
What Happens on Windows?
Windows supports passkeys through Windows Hello and other credential providers.
A passkey stored locally with Windows Hello can be unlocked using facial recognition, fingerprint authentication or the Windows Hello PIN. Windows can also work with synced credential managers, mobile devices and FIDO2 security keys depending on the configuration.
This means the familiar Windows Hello prompt is not necessarily just unlocking the computer anymore.
It can also authorise a website or application’s passkey.
Windows 11 includes native passkey management, while Microsoft’s newer passkey infrastructure also supports third-party credential providers and its own Microsoft Password Manager.
From the user’s perspective, the experience is similar to the phone: the website asks for authentication and Windows asks you to prove that you are the person authorised to use the credential.
Can a Phone Passkey Be Used on a Laptop?
Yes, and this is one of the most useful parts of the system.
Imagine that your passkey exists on your iPhone or Android phone but you are trying to sign into a website on a computer where that credential is not stored.
Instead of falling back immediately to a password, the computer can display a QR code. You scan it with the phone, approve the request and the phone performs the authentication on behalf of the computer. Google and Apple both document this type of cross-device sign-in.
FIDO calls this Cross-Device Authentication. Bluetooth Low Energy is used to verify that the phone and computer are physically close to each other, while additional cryptographic protections secure the actual authentication exchange.
That physical-proximity check is important.
Scanning a random QR code from the other side of the world should not be enough to turn the phone into a remote authentication device.
Why Does Bluetooth Sometimes Need to Be On?
This can initially seem strange because the QR code appears to handle the connection.
Bluetooth has a different role.
In cross-device authentication, it helps confirm that the phone containing the passkey is physically near the computer requesting authentication. FIDO notes that the protocol does not rely purely on Bluetooth’s own security for the login itself; additional cryptographic protections are used for the authentication data.
Google therefore instructs users to enable Bluetooth when using a phone’s passkey to sign into another computer
The QR code establishes the interaction.
Bluetooth helps prove proximity.
The passkey handles the actual cryptographic authentication.
Why Are Passkeys Resistant to Phishing?
A password can be typed anywhere.
That is exactly what makes phishing possible.
A fake website can imitate the real login page and convince someone to enter the correct password. Once the attacker has it, that same credential may be usable against the legitimate service.
A passkey behaves differently because it is cryptographically associated with the website or app for which it was created. FIDO and Apple both describe passkeys as phishing-resistant because the credential cannot simply be entered into an imitation website.
This is one of the most important advantages of the technology.
Security no longer depends as heavily on the user recognising every convincing fake login page.
The authentication system itself knows that the credential belongs somewhere else.
What Happens if You Buy a New Phone?
With a synced passkey, changing phones can be relatively straightforward.
If the new device is connected to the same passkey provider account, the credentials can become available through the provider’s synchronisation system. FIDO describes synced passkeys as becoming available across devices connected to the same provider, including newly configured devices.
For example, passkeys stored in iCloud Keychain can follow a user across supported Apple devices.
This is one reason synced passkeys are important for mainstream adoption. A password is extremely portable because someone can simply remember or copy it. A password replacement needs another way of surviving device upgrades without forcing the user to recreate every credential manually.
Cloud-backed credential managers are designed to provide that continuity.
But Not Every Passkey Syncs
This distinction matters.
A passkey stored locally through Windows Hello, for example, can be device-bound rather than automatically synchronised to another Windows computer. Microsoft’s documentation for certain Windows passkeys explicitly notes that a locally stored credential may require separate registration on each device.
Hardware security keys work on a similar principle: the credential lives on the physical authenticator rather than automatically appearing on every phone or laptop.
Neither approach is inherently better.
A synced passkey prioritises convenience and recovery across devices.
A device-bound credential can be useful when an organisation wants tighter control over exactly where the authentication credential exists.
For ordinary consumers, the main lesson is simply this:
“Passkey” does not automatically mean “stored in the cloud.”
Where you choose to save it matters.
What Happens if You Lose Your Phone?
This is probably the most important practical question.
If the lost phone was only one device connected to a synced passkey provider, the situation may be relatively easy to recover from. Another trusted device or a replacement device connected to the same provider can restore access to synchronised passkeys.
If the credential was device-bound and no alternative passkey exists, recovery depends on the service. The user may need another registered device, a physical security key or whatever account-recovery mechanism that service provides.
This is why relying on a single device-bound credential without understanding the recovery options can be risky.
Passkeys eliminate the problem of forgetting a password.
They do not eliminate the need for a recovery plan.
Can Someone Use My Passkeys if They Steal My Phone?
Stealing the phone alone should not normally be enough.
The attacker would also need to pass the device’s local authentication mechanism, such as Face ID, fingerprint verification or PIN.
That makes the security of the device lock extremely important.
A weak phone PIN undermines more than access to the phone itself when the device also contains payment cards, email, authentication apps and passkeys.
The smartphone increasingly acts as a digital identity device, which means protecting the device itself becomes a central part of account security.
This is also why Google advises users not to create passkeys on shared devices.
Can You Have More Than One Passkey for the Same Account?
Often, yes.
A service may allow users to register several passkeys, for example one on a phone, another on a laptop and another on a hardware security key.
This can be useful when using device-bound credentials because another passkey effectively becomes a spare way into the account.
With synced passkeys, the same credential provider can already make the credential available on multiple devices, so the experience can be more seamless.
The exact implementation still depends on the service.
Passkeys provide the authentication technology, but individual websites decide how registration, recovery and credential management work around it.
Do Passkeys Work Only With Face ID or Fingerprints?
No.
Biometrics are convenient, but they are not required.
A passkey can also be unlocked using the device PIN or another secure local authentication method. Google, Microsoft, Apple and FIDO all support this model.
On Windows, for example, Windows Hello can fall back to the device PIN when biometric authentication is not configured or available.
This is worth understanding because passkey does not mean biometric login.
Biometrics are simply one convenient way of authorising access to the credential.
Can Passkeys and Passwords Exist Together?
Yes, and today this is extremely common.
A website may allow a user to create a passkey while retaining the traditional password as a fallback. Apple explicitly describes passkeys as capable of working alongside passwords during the transition, while Google notes that adding a passkey to a Google Account does not automatically remove existing authentication or recovery factors.
That is useful during adoption, but it creates an important security nuance.
If an account has an excellent phishing-resistant passkey but still allows an attacker to log in using a weak password fallback, some of the old risk remains.
Passkey adoption and password retirement are therefore not necessarily the same thing.
For consumers, the important step is to check what authentication methods remain active after creating a passkey.
Do You Still Need a Password Manager?
Possibly — but its role is changing.
Password managers increasingly support both passwords and passkeys. FIDO identifies operating-system vendors and third-party services such as password managers as possible passkey providers.
That means a password manager can evolve into something closer to a general credential manager.
Instead of storing only text passwords, it can also hold cryptographic passkeys and synchronise them across supported devices.
During the transition period, this can be useful because most people will have a mixed digital identity: some accounts use passkeys, some remain password-based and others use social login or additional MFA.
The password manager may therefore survive the password.
It simply manages more than passwords.
What About Android?
On Android, passkeys can be stored and used through supported credential managers, including Google Password Manager. A user can authenticate using the phone’s screen lock, fingerprint or face recognition, depending on the device and configuration.
Google also supports using an Android phone’s passkey to sign into another computer through the QR-based cross-device process.
The general experience mirrors what happens on other platforms: the operating system or credential manager presents the appropriate passkey, the user confirms locally and the service receives cryptographic proof rather than a reusable password.
This cross-platform model is important because passkeys are not an Apple, Google or Microsoft proprietary authentication concept. The technology is based on FIDO standards and WebAuthn, allowing different ecosystems to participate in the same broader system.
What About Macs?
Apple integrates passkeys into the same iCloud Keychain system used across its ecosystem.
If a passkey is created on an iPhone and synchronised through iCloud Keychain, it can also become available on a Mac signed into the same Apple Account. The user can then authenticate through the Mac’s supported local authentication method.
The reverse is also possible: a passkey created within the Apple ecosystem can follow the user across compatible devices.
More importantly, owning a Mac does not lock the passkey exclusively inside Apple hardware. An iPhone can also authenticate a login occurring on another platform through cross-device authentication.
This is one of the areas where passkeys are becoming much less ecosystem-restricted than they appeared during their earliest implementations.
QR Code Login Does Not Mean the Passkey Moves to the Computer
This distinction can easily be missed.
If you use your phone to scan a QR code and authenticate a login on another computer, the passkey does not necessarily get copied onto that computer.
The phone can simply act as the authenticator for that particular login.
That is useful when using a borrowed computer, a shared workstation or a device where you do not want to permanently store your credential.
Apple explicitly supports using an iPhone’s stored passkey to sign into websites on devices not associated with the user’s Apple Account, including another person’s computer.
In other words, a passkey can travel functionally without necessarily travelling physically.
A Shared Computer Requires Extra Attention
Passkeys make authentication easier, but convenience can become dangerous if the credential is saved in the wrong place.
Creating a passkey directly on a shared computer may give anyone capable of unlocking that computer access to the associated account.
The safer approach when using an unfamiliar device is often cross-device authentication: keep the credential on your own phone and use it temporarily to approve the login.
This is similar to the rule people already follow with password managers.
A personal device can store long-term identity.
A borrowed device should ideally receive only the temporary access required for the session.
Passkeys Do Not Eliminate Every Security Problem
Passkeys solve several major weaknesses of passwords, particularly phishing, password reuse and server-side password theft.
They do not make an account impossible to compromise.
An attacker might target the user’s device, exploit a weak recovery process, hijack an authenticated session or use other forms of social engineering.
Security therefore does not become irrelevant.
The threat model changes.
The advantage is that one of the oldest and most scalable attack techniques — tricking users into handing over reusable passwords — becomes much harder when there is no reusable password to hand over.
The Consumer Shift Is Already Underway
The wider change goes beyond the technology itself.
The published Athens Pulse article “The Slow Death of the Password: Why Logging In Is Finally Changing” examines how authentication is gradually moving from something users need to remember toward something their devices can verify for them.
From the Techrow.gr perspective, passkeys are the practical mechanism making that transition possible. The experience increasingly resembles unlocking a phone rather than filling in a security form.
The user still proves identity.
The difference is that the device handles much more of the difficult part.
Easier Authentication Can Also Matter to Conversion
Removing passwords can have another effect that is less visible from the device itself.
The published Targeted.gr article “Login Friction: How Authentication Can Cost Brands Conversions” examines how forgotten passwords, recovery screens and account-creation friction can interrupt checkout or other high-intent customer journeys.
For users, passkeys can reduce some of those interruptions by replacing typing, remembering and resetting with a familiar local verification step.
That does not guarantee a good login experience — poor implementation can still create confusion — but it explains why passkeys are becoming relevant beyond cybersecurity.
Authentication is also UX.
Businesses See a Different Side of the Same Technology
For companies, passwords create work that users rarely see: reset systems, helpdesk tickets, recovery procedures, phishing protection and identity-management infrastructure.
The published Market Insiders article “The Authentication Cost: What Businesses Pay for Password-Based Identity” examines that operational side of the transition.
Passkeys can potentially remove some recurring password-related problems, but businesses still need to manage device migration, recovery, credential providers and users who remain on older authentication methods.
That means passwordless technology is not simply about replacing one login box with another.
It changes the entire lifecycle of a digital credential.
What Should You Do When a Website Offers to Create a Passkey?
For most personal accounts, the first thing to check is where the passkey will be saved.
If it is going into a credential manager you already use and trust across your devices, the experience can be very convenient. If it is being stored locally on a single machine, think about whether you have another recovery method available.
You should also avoid creating passkeys on public or shared devices and ensure that the device itself has a strong lock method.
It is worth checking whether the service keeps the old password active after passkey creation as well. During the transition period, many accounts continue supporting several sign-in methods.
The passkey may be excellent.
The security of the account is still influenced by every other way the account can be recovered or accessed.
The Most Important Thing to Understand About Passkeys
Passkeys can sound complicated because terms such as public-key cryptography, WebAuthn, credential providers and cross-device authentication sit underneath them.
The user experience is much simpler.
A passkey is essentially a secure digital credential that your device manages so that you no longer need to remember and type the secret yourself.
Your fingerprint or PIN unlocks it.
Your credential manager may synchronise it.
Your phone can sometimes use it to authenticate another computer.
And the website verifies cryptographic proof rather than receiving a reusable password.
Once that distinction becomes clear, the entire idea is easier to understand.
A password asks:
“What secret do you know?”
A passkey increasingly asks:
“Do you possess the trusted credential, and can you unlock it?”
That is why passwordless login can feel simultaneously more advanced and much simpler.
Frequently Asked Questions
What is a passkey?
A passkey is a cryptographic credential that can replace a traditional password. It is stored on a device, security key or credential manager and can be unlocked using a fingerprint, face recognition or device PIN.
Is my fingerprint stored inside the passkey?
No. Biometrics are used locally to authorise use of the credential. Your fingerprint or face data is not sent to the website as the passkey.
Can I use an iPhone passkey on a Windows PC?
Yes. A supported website can display a QR code that you scan with the iPhone, allowing the phone to authenticate the login on the PC without permanently moving the passkey to that computer.
What happens to my passkeys when I change phones?
If they are stored in a synced passkey provider, they can become available on the new device after you sign into and set up the same provider. Device-bound passkeys may require separate registration or another recovery method.
Are passkeys safer than passwords?
They remove several major password weaknesses. Passkeys are designed to resist phishing, cannot be reused across unrelated websites and do not require the server to store the same kind of reusable secret used in password authentication.
Can I still use my password after creating a passkey?
Often, yes. Many services currently support passkeys alongside passwords during the transition. The exact behaviour depends on the account and service.
Do passkeys require Face ID or a fingerprint reader?
No. They can also use a secure device PIN or other local unlock mechanism. Biometrics are convenient but are not required for the underlying passkey technology.
Should I create a passkey on a shared computer?
Generally, it is safer not to store a personal passkey permanently on a shared device. Where supported, cross-device authentication lets you keep the credential on your own phone and use it to approve the login instead.