Passkeys

A passkey is the sign-in your device already does — Windows Hello, Face ID, Touch ID, Android biometrics. It is faster than a password, and it cannot be phished.

It is additive: adding a passkey does not take your password away, and password sign-in with a second factor keeps working exactly as before.

Add a passkey

On your Security page, add a passkey. Your device asks you to confirm with whatever it normally uses, and that is the setup.

You can add more than one — a phone and a laptop, say — so losing one device does not lock you out.

Where it earns its keep

On the crew’s phone. A technician standing on a driveway signs in with their face rather than typing a password and then reading a code out of an email with cold hands.

That is also why somebody invited to join a business can finish joining with a passkey and never set a password at all. The office created the account, and a password nobody chose is a password somebody writes on a sticky note.

Why it cannot be phished

A passkey is bound to this website. Presented with a convincing look-alike domain, your device will not offer the passkey, because the address does not match the one it was created for.

A password can be typed into anything. That is the entire difference, and it is why a passkey is stronger than a password and a code together.

Where your fingerprint goes

Nowhere. A passkey is a key pair, and the private half never leaves your device.

Your fingerprint and your face never reach us, never travel over the network, and are not something this product could hand over if it were asked. What we hold is the public half, which is useless on its own.

If you lose the device

Sign in with your password and your second factor, then remove the lost device’s passkey from your Security page — and check Keeping the account secure, where you can also sign that device out of everything.