Should you use passkeys or passwords? And what’s the difference between them?
Sick of remembering each password for each account? Try a passkey. This security tool is a fundamental shift away from passwords altogether.
Watch: The truth about Arizona's water shortage and your bills | 11 mins
Q: What’s the difference between a password and a passkey?
A: If you’ve ever been frustrated with remembering passwords, dealing with password managers, or worrying about your credentials getting hacked, passkeys are here to change the game. They’re not just a better security feature; they’re a fundamental shift away from passwords altogether.
What is a passkey?
A passkey is a more secure and convenient way to sign in to your accounts that eliminates the need to remember passwords. It uses public-key cryptography, meaning that instead of storing your login credentials on a website’s server (which can be hacked), a unique private key stays securely on your device. When you log in, your device authenticates you using biometrics (Face ID, fingerprint) or a PIN.
Because passkeys can’t be phished, reused, or stolen in a data breach, they’re much safer than traditional passwords.
How does a passkey work in everyday use
Let’s say you want to log into your Google account. Instead of typing in a password, your phone automatically verifies your identity with your fingerprint, face scan, or a device PIN. That’s it—you’re in! No need to remember a complex string of characters.
Even better, passkeys sync across your devices through your cloud account (like iCloud for Apple users or Google Password Manager for Android users). So, if you set up a passkey on your phone, you can also use it on your laptop without extra steps.
It’s also a way to successfully use long complicated and unique passwords on all your accounts.
Setting up passkeys on popular accounts
Google Accounts: Go to g.co/passkeys and make sure you are signed in, then click ‘Create a passkey’ and follow the on-screen instructions.
Choose whether to use Face ID, Touch ID, or a PIN for authentication. If your computer doesn’t have a biometric interface, you can either add one or just use a PIN.
Once it’s been set up, the next time you log in, you’ll just use your chosen method instead of a long complicated password.
Apple ID: On an iPhone or Mac, go to Settings > Passwords & Security, then tap ‘Passkeys’ and enable the feature.
When prompted to sign in somewhere (like iCloud.com), your device will use Face ID or Touch ID instead of a password.
Amazon: In Your Account, select Login & security, then ‘Set up’ beside Passkeys and follow the on-screen instructions to complete the setup.
Log in on a new device
If you’re using a device that doesn’t have your passkey saved, you may still log in by scanning a QR code with your phone if the site offers it, which verifies your identity. This keeps your account secure while allowing flexibility on other trusted devices.
The end of passwords?
Not every site supports passkeys yet, but companies like Google, Apple, and Microsoft are pushing for broad adoption. In some cases, there is no password involved at all when creating a new account.
In other cases, you’ll need to keep a record of your password in the event your authentication device is lost, although most also offer account recovery via email, recovery keys, or other trusted devices.
As passkeys become an available option on your accounts, I’d highly recommend using them.
Comments
3 Comments
What do you do in a case where you have an account that is shared with someone like a spouse say a bank account. Can he or she log into that account once you set up a pass key?
Passkeys have some advantages, especially if that is all that was use, but there is usually "backup" ways if your passkey doesn't work, and your security is only as good as the weakest link. Also, I use Yubikey hardware devices for authorization, and in many cases, if you add a passkey, your Yubikey stops working, or if you add a Yubikey after a passkey, your passkey stops working. Its a mess, since there is no standard, and ever site uses something different.
"instead of storing your login credentials on a website’s server (which can be hacked)..."
It's a minor point but that's not true: most websites store an irreversible hash of the password so they can't be stolen in a hack.