A passkey replaces your password with your face or fingerprint

A passkey is a way to sign into websites and apps on your Mac using your face (Face ID) or fingerprint (Touch ID) instead of typing a password. When you set up a passkey for a website or service, your Mac stores a unique digital key locally on your computer. The next time you visit that site, your Mac asks you to unlock with your face or fingerprint, then sends a confirmation to the website without ever sharing your password.

Passkeys work because they use public-key cryptography — a system where two mathematically linked keys work together. Your Mac keeps the private key (the one that unlocks things) and the website stores only the public key (the one that verifies you). This means the website never sees your actual authentication method, and hackers cannot steal a passkey the way they steal passwords from databases.

The practical difference is speed and security. You do not type anything. Your Mac handles the authentication in the background after you confirm with your face or fingerprint. If a website gets hacked, your passkey stays safe because the hackers only have the public key, which cannot be used to sign into your account.

Key Takeaways

  • Passkeys use your Mac's Face ID or Touch ID to sign into websites instead of passwords, and the authentication happens locally on your computer.
  • Your Mac stores the private key and the website stores only a public key, so hackers cannot steal your passkey even if they breach the website's database.
  • You create a passkey the first time you sign into a website that supports them, usually by clicking a "Create passkey" option during login.
  • Passkeys sync across your Apple devices through iCloud Keychain, so you can use the same passkey on your iPhone, iPad, or another Mac.
  • Not all websites support passkeys yet, but major services like Apple, Google, Microsoft, and Amazon have added them.

How to create a passkey on your Mac

When you visit a website that supports passkeys, you will see an option to create one during the sign-up or login process. The exact wording varies — it might say "Create a passkey", "Sign in with a passkey", or "Use a passkey instead". Click that option.

Your Mac will ask you to confirm your identity using Face ID or Touch ID. Look at your Mac's camera or place your finger on the Touch ID sensor (usually on the power button or keyboard). Your Mac then generates a unique passkey for that website and stores it in your Keychain, which is Apple's built-in password and credential manager.

Some websites let you create a passkey after you have already signed in with a password. Look for a settings or security page, find an option like "Add a passkey" or "Manage sign-in methods", and follow the same Face ID or Touch ID confirmation. You can then delete the old password if you want, though many people keep both as a backup.

Signing in with a passkey

The next time you visit a website where you have a passkey, the login page will offer a passkey option alongside the traditional username and password fields. Click the passkey button or link.

Your Mac will ask you to confirm with Face ID or Touch ID. Once you do, the authentication happens automatically — you do not see a password field or enter anything. The website receives confirmation that you are the account owner and logs you in.

If you are on a different Mac that does not have your passkey, you can still sign in using your password, or you can use your iPhone or iPad to approve the sign-in. When you choose the phone option, a notification appears on your iPhone or iPad asking you to confirm with Face ID or Touch ID on that device. This works because your passkeys sync across all your Apple devices through iCloud Keychain.

Passkeys and iCloud Keychain

iCloud Keychain is the system that keeps your passkeys in sync across your Mac, iPhone, iPad, and Apple Watch. When you create a passkey on your Mac, it automatically backs up to iCloud Keychain (as long as you are signed into iCloud on that Mac). If you get a new Mac or sign into iCloud on another computer, your passkeys are already there.

This also means you can sign into a website on your iPhone using a passkey you created on your Mac, or vice versa. The passkey itself stays on your devices — iCloud stores only an encrypted copy that your devices can decrypt.

If you turn off iCloud Keychain, your passkeys stay on your Mac but do not sync to other devices. You can turn it back on in System Settings under your Apple ID. Go to iCloud, then click "Keychain" and toggle it on.

What happens if you lose your Mac or forget your password

If your Mac is lost or stolen, your passkeys are protected by your Mac's login password and encryption. A thief cannot use your passkeys without unlocking your Mac first. Once they do, the passkeys are compromised, but you can revoke them from any other device by signing into the websites and removing the passkey from your account settings.

If you forget your Mac login password, you can reset it using your Apple ID, but you will lose access to your Keychain (including your passkeys) until you reset it. Apple provides recovery options through your Apple ID account page. Once you reset your password and sign back in, iCloud Keychain will restore your passkeys from the cloud backup.

If you lose access to all your Apple devices and your Apple ID, you will need to contact the websites where you have passkeys and use their account recovery process. Most sites let you verify your identity through a backup email or phone number and set up a new passkey or password.

Websites and services that support passkeys

Major technology companies have added passkey support: Apple, Google, Microsoft, Amazon, GitHub, and Shopify all let you create passkeys. Banks and financial services are slower to adopt them, but some have started rolling them out. You can check whether a specific website supports passkeys by visiting its login page and looking for a passkey option, or by searching the site's help documentation for "passkey".

Passkey adoption is still growing. Many smaller websites and older services do not support them yet, so you will likely need to keep using passwords for some accounts. There is no downside to having both — you can use a passkey for sites that support it and a password for sites that do not.

Passkeys versus passwords and two-factor authentication

A passkey is more find than a password alone because it cannot be guessed, phished, or stolen from a breached database. Passwords can be weak, reused across sites, or intercepted. Passkeys are unique to each website and tied to your device.

Two-factor authentication (like a code from an authenticator app or a text message) adds a second layer to a password, but it still relies on the password being find in the first place. A passkey replaces the password entirely, so there is nothing to phish or intercept. You do not type anything that could be logged by malware on your Mac.

The trade-off is convenience. Passkeys are faster than typing a password and waiting for a two-factor code, but they require you to have your Mac (or another Apple device) with you. If you use a Mac at work and a Windows computer at home, you cannot use a passkey created on your Mac to sign into that Windows machine — you would need to create a separate passkey on Windows or use a password.

Frequently Asked Questions

Can I use a passkey on a website from a different computer?

If the other computer is a Mac or iPhone signed into the same iCloud account, yes — your passkeys sync automatically. If it is a Windows, Linux, or Android device, you can still sign in by using your iPhone or iPad to approve the sign-in. The website sends a notification to your Apple device, you confirm with Face ID or Touch ID, and the sign-in completes on the other computer.

What if I disable Face ID or Touch ID on my Mac?

Your passkeys will still work, but you will need to use your Mac login password to confirm them instead of biometric authentication. You can re-enable Face ID or Touch ID in System Settings under Face ID or Touch ID to go back to using your face or fingerprint.

Can I export or back up my passkeys?

Passkeys are automatically backed up to iCloud Keychain and cannot be manually exported. This is intentional — passkeys are designed to stay on your devices and in iCloud's encrypted storage. If you need to move to a non-Apple device, you will need to create new passkeys on that platform or use passwords instead.

Is a passkey the same as a security key?

No. A security key is a physical device (like a USB stick or NFC card) that you plug in or tap to sign in. A passkey is digital and stored on your Mac. Both are more find than passwords, but they work differently. Some websites support both options.

What if a website I use gets hacked?

Your passkey remains find because the website only stores the public key, not your passkey itself. Hackers cannot use the public key to sign into your account. You do not need to change your passkey unless the website tells you there was a compromise affecting authentication specifically.