passkey

basicspreading

A passkey is a password-free login method where your phone or computer verifies to the website that it is you using a secret key stored on the device. You unlock the key with a fingerprint, face recognition, or PIN; you do not need to type a password.

In plain terms

A password is like a secret word that you know and the website verifies. If it leaks or is tricked out of you, anyone can log in with it, especially if you use the same one on multiple sites. A passkey is more like a house key that never leaves your pocket: the website guards only the lock, while the key remains with you.

In practice, this means you type nothing upon logging in. Your phone or laptop asks if it is really you (fingerprint, face, PIN code) and handles the rest in the background.

Its greatest advantage is that there is no secret you could give away, and nothing can be stolen from the website that would let someone log in as you. A fake banking page may look convincing, but the passkey only works on the real site's address, so most phishing scams simply bounce off it.

This has become particularly important because artificial intelligence now enables the mass production of deceptive emails and fake pages with flawless Hungarian. The password key does not leave protection solely to your vigilance.

How it works

When you create a passkey with a service, your device generates a matching key pair: a private one and a public one.
The public key is received by the website. The private key remains in your device's secure storage or password manager. If you synchronize it, it is transferred to your other devices only in encrypted form, never in readable form.
Upon login, the website sends a one-time challenge that can only be correctly signed with the secret key.
The browser checks whether the request truly comes from the website to which the key belongs. Your device asks if it is you (via fingerprint, face, or PIN), and only then signs the challenge.
The website verifies the signature with the public key and grants access. Your fingerprint or face image never leaves the device.

An everyday example

You want to log into your email on a new laptop, and instead of a password, a QR code appears. You scan it with your phone, place your finger on the sensor, and you are in. The phone must be near the laptop because the two devices check via Bluetooth that they are next to each other. Meanwhile, you typed nothing that a fraudster could steal or trick you into revealing.

Who is affected

everyoneMajor email, social media, and shopping platforms are rolling out the offer, so sooner or later you will encounter the question of whether to create a passkey.

bank customer, investorThis is one of the most effective defenses against phishing scams targeting financial accounts, as it does not function on fake sites. → Money

entrepreneur, executiveCorporate account breaches very often start with a stolen or reused password, and the passkey closes this door.

developerYou must integrate it into the login process. You also need to consider how an AI agent can access the account without requiring you to hand over the user's key. → Code

A common misconception

MythWhen using a passkey, the website receives and stores my fingerprint or facial image.

In realityBiometric data only unlocks the key on your own device and does not leave it. The website sees only a public key, which cannot be used on its own.

Limits and risks

If you lose your device and the key is not synchronized or you lack an alternative access method, recovering the account can be difficult.
The security of synchronized password keys depends on the account (Apple, Google, Microsoft, or a password manager) in which you store them, so protect that account especially.
Many services keep the old password login alongside the key, so the weak link remains until you disable it or switch to a strong password.
It does not protect against every kind of fraud: if someone gets hold of your unlocked phone, or talks you into approving a transfer yourself, the passkey will not help.

Similar, but not the same

password manager – A password manager traditionally stores and fills in passwords for you. With a passkey, however, there is no password that can be filled in or stolen. Many password managers today can also store passkeys.
two-factor authentication – There, a second step (such as an SMS code) is added to the password. A passkey triggers both with a single gesture, as it simultaneously verifies that you have the device and that you are you. Unlike codes, it cannot be tricked out of you.
biometric identification – Fingerprint or facial recognition only unlocks the key stored on the device. The website authenticates you with the key itself, not your body.

Related concepts

Broader

authentication, passwordless login, cybersecurity

Narrower

synced passkey, device-bound passkey

On the edge

security key, two-factor authentication, phishing, password manager, biometric identification, public-key encryption

A brief history

The WebAuthn standard, which underpins passkeys, was adopted by the W3C in March 2019 as an official web recommendation. The standard is the result of joint work with the FIDO Alliance industry consortium (FIDO2). In May 2022, Apple, Google, and Microsoft jointly announced that their systems would support passkeys synchronizable across multiple devices. From that point on, the name passkey spread among the general public.

Where things stand

By the end of 2026, major operating systems, browsers, and password managers all support it, and major providers increasingly offer it as the default login method. However, it has not yet replaced passwords: on most sites, the two coexist.

Status: 2026 November

In the news

Appears in 3 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Hackers hit OpenCode AI coding tool, running up charges on users' AI accountsOct 19, 2026 · Code
Survey: 79% of workers have entered sensitive data into AI tools, and many use them in secretSep 21, 2026 · Work & HR
AI-related DevOps incidents nearly triple year over year, GitProtect Lab findsAug 18, 2026 · Code

Also known as

passkey · passkeys · passkey · jelkulcs · API key · access key · FIDO2 credential

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.