What Is a Passkey and Should You Replace Your Passwords in the UK?

Your password is a secret you hand over to a website every time you sign in. A passkey is a secret you never hand over at all. That one difference explains why Google, Apple, Microsoft, PayPal and a growing number of banks are nudging millions of people away from passwords and towards something built on cryptographic keys.

If you have seen a "Create a passkey" prompt on your phone or laptop recently and clicked past it, this is for you. Here is what a passkey actually does, where it works in the UK, and how to adopt one without locking yourself out of your own accounts.

What a passkey actually is

A passkey is a pair of mathematically linked keys. The private key lives on your device — inside the secure chip on your phone, or in a password manager such as iCloud Keychain, Google Password Manager, 1Password or Bitwarden. The public key sits on the website's servers.

When you sign in, your device proves it holds the private key without ever transmitting it. You unlock that key with your face, your fingerprint, a Windows Hello PIN, or your phone's passcode. The underlying standards are called WebAuthn and FIDO2, which is why passkeys work across different browsers and devices rather than being tied to one company's app.

Nothing is typed, so nothing can be guessed, shoulder-surfed, or copied from a leaked database of passwords.

What signing in looks like in practice

1. You enter your email address on a site that supports passkeys and choose the passkey option instead of the password field.
2. Your device shows a prompt asking you to confirm with Face ID, Touch ID, Windows Hello or your device PIN.
3. Your device signs a one-time challenge from the site using the private key.
4. The site checks that signature against your stored public key and lets you in.

The whole exchange usually takes two or three seconds. If you are signing in on a desktop computer but your passkey lives on your phone, the site will often display a QR code you scan with your camera, then approve the sign-in on the phone itself.

Why passkeys are harder to phish than passwords

Most account takeovers start with a fake login page. You type your password into a convincing copy of your bank's website, and it goes straight to a criminal. Passkeys largely defuse that attack, because the credential is cryptographically bound to the genuine web address. Hand it to a lookalike domain and it simply will not work.

Three other advantages matter:

• No reuse. Each passkey is specific to one account, so a breach at one company cannot be replayed against another. Credential-stuffing attacks, where stolen email and password pairs are tried across hundreds of sites, stop working.
• No shared secret on the server. There is no password hash to steal, because there is no password.
• Nothing memorable to lose. There is no string to forget, write on a sticky note, or reuse badly.

That is not the same as invulnerable. Someone who has your unlocked phone and knows your PIN can approve a prompt they should not. Attackers can also spam sign-in requests in the hope you tap approve out of irritation. Treat your device passcode as seriously as you would treat your password.

Which UK services support passkeys

Support is broad among the big technology platforms: Google accounts, Apple IDs, Microsoft accounts, PayPal, Amazon, eBay, TikTok, X and WhatsApp all offer passkeys, at least on some platforms and in some regions. Many password managers will also generate and store passkeys for you, syncing them across your devices.

UK banking is moving more slowly, which is understandable given the regulation involved. Several banks and building societies have added passkeys inside their mobile apps, and others are testing them. The catch is that support can vary by app version, device and account type, so it is worth searching your banking app's security settings to see what is offered. Government sign-in services are heading the same way, though availability depends on which service you are using.

A sensible rule: check the security or sign-in settings of any account you care about. If a passkey option appears, it is usually the strongest choice on the list.

The catches worth knowing

• Your passkeys usually live in a cloud account. If they sync through iCloud or your Google account, that account becomes the master key. Protect it with a strong, unique password and two-factor authentication.
• Losing a device is not the disaster it sounds like — provided you set up a second passkey on another device, or your passkeys are synced. Do that on day one, not after the phone goes in the washing machine.
• Shared devices need thought. A family tablet where several people sign in is not the place for a passkey tied to one person's face or fingerprint.
• You will still need passwords for years. Plenty of sites, including small shops and older services, have not adopted passkeys. Keep your password manager.
• Recovery flows still matter. Many services will let you reset access through your email address, so a compromised inbox can undo good passkey hygiene. Secure your email account first.

Treat a passkey like a house key: keep a spare somewhere sensible, and know exactly who else can get in.

How to switch without locking yourself out

Start with one account you use daily and would notice losing — your Google or Apple account is a good candidate because it tends to hold your passkeys for other services. Add the passkey, confirm it works, then leave the password in place as a fallback rather than deleting it immediately.

Next, register a second passkey on a different device. If your first lives on an iPhone, add one on a laptop or a hardware security key such as a YubiKey. This is the step most people skip, and it is the one that saves them a stressful afternoon on a support line.

Then spend ten minutes on housekeeping: check that your recovery email and phone number are current, make sure two-factor authentication is switched on for the accounts holding your passkeys, and give each passkey a clear name such as "Work laptop" or "iPhone 15" so you can tell them apart later.

If you manage accounts for someone else — a parent, a partner, a teenager — sit down and do theirs alongside yours. Passkeys remove a lot of everyday friction, but they shift responsibility onto the device and the cloud account behind it. A little planning now means you get the security benefit without the lockout risk.

Photo: rmartinr / Pixabay