Add passkeys - a login a fake site can’t steal
A passkey is the newest and strongest everyday sign-in. Instead of a password you type - which a convincing fake page can capture - your device proves it’s you with a key that never leaves it, so there’s nothing to phish. They’re free, built into the phone and laptop you already own, and more accounts support them every month.
What a passkey is, in one line
A sign-in tied to your device and unlocked by your fingerprint or face - no password to type, remember, reuse, or leak. The website only ever sees proof, never a secret it could lose in a breach.
Where your passkeys live
Your phone, computer, or password manager stores them and syncs them across your devices - iCloud Keychain on Apple, Google on Android and Chrome, or your password manager if it supports passkeys. Pick one home for them so they’re with you on every device.
Turn them on where they’re offered
In an account’s security settings, look for “passkey” or “sign in without a password”. Start with the big accounts that support it - Google, Microsoft, Apple, Amazon, PayPal, and a growing number of banks. Each takes about a minute to add.
Keep a backup way in
Add the passkey, but leave your app-based two-step switched on too, so losing a device doesn’t lock you out. A passkey is an upgrade, not a burning of bridges.
For the crown jewels: a physical key
If you’re higher-risk, a hardware security key (a YubiKey or similar) is the strongest option of all for your most critical accounts - email, bank, password manager. Optional for most people; worth knowing it exists.
“Do I have to give up passwords?”
No, and don’t rush to. Add passkeys where they’re offered and keep your password manager and two-step for everything else. Over time, more accounts will let you drop the password entirely - but there’s no hurry, and no downside to going gradually.
Last checked: 19 October 2026. Passkey support is spreading fast - more accounts will offer it than when this was written.