What changes when you sign in?
Instead of typing a password into the website, you approve the use of a passkey through the device’s intended verification, such as a PIN or biometrics. The passkey is bound to the correct service, giving particular protection against credentials being captured on fake pages. Since 2026, the NCSC recommends passkeys where available. They do not prevent every kind of deception: a fraudulent shopping offer can still persuade someone to make a payment voluntarily.
Is the device genuinely my protected access point?
Fictional example: Mara wants to try a passkey for an existing service. She uses her own updated phone with a screen lock she does not share with strangers. She avoids the publicly used computer in her community room. Someone who can unlock a device may, depending on the system, also use its stored passkeys. On shared equipment, it therefore matters whether user accounts and access are actually separated rather than merely appearing to be separate.
Where is the passkey stored and what synchronises?
Read the setup prompt: which device or password manager will store the credential? Some arrangements synchronise it through a protected account to other devices you own; others depend on specific hardware. Do not assume every passkey automatically becomes available everywhere. Protect the account managing synchronisation and understand how that account is recovered. If useful, record the manager’s name, but do not put your device-unlock PIN in an openly shared document or casual message.
What happens when I replace or lose the phone?
Open the service’s current official help beforehand. Clarify whether another personal device, an additional supported sign-in route or a particular recovery procedure is available. A second device only helps when the credential you need is actually available and protected there. Following loss, remove or secure the affected credential or device according to the provider’s instructions. Exact steps differ, so guidance written for another ecosystem does not automatically apply to your account and equipment.
Begin with a manageable test
Start with an existing, less critical service that officially supports passkeys and follow its instructions. Afterwards, inspect the list of sign-in methods and test another sign-in without prematurely losing your only working access. Do not remove recovery options simply to tidy the list. If a password remains as an alternative, it still needs protection. Follow your organisation’s rules for work accounts. When an on-screen prompt is unclear, read official help rather than approving things at random.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Is my fingerprint sent to the website?
In ordinary passkey implementations, the device checks unlocking locally. Google explicitly states that biometric information stays on the device in its implementation. The website receives cryptographic proof, not an image of your fingerprint or a recording of your face.
Is a passkey just another name for my phone PIN?
No. The PIN may authorise use of a passkey managed on your device. It is not the passkey itself and should not be entered into an unfamiliar form or given to someone calling you on the phone.
Should I create a personal passkey on a shared device?
Not without clearly separated and protected access. Someone who can unlock the relevant device or profile may also be able to use the passkey. Prefer your own protected device and review the service’s guidance for shared devices.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- NCSC: Passkeys – what you need to knowSource review date:
- Google Account Help: Sign in with a passkeySource review date:
- FIDO Alliance: PasskeysSource review date:
