Passwords have a fundamental weakness that no amount of complexity fixes: they’re a shared secret that has to travel between you and a server, and anywhere along that path, they can be intercepted, phished, or leaked in a breach.
Passkeys work differently. They’re built on public-key cryptography, the same underlying technology that secures HTTPS connections, and they never transmit a secret that could be stolen or phished in the first place.
Android has built-in support for passkeys, and more services add support every month. Setting this up takes a few minutes per account, and the security improvement is genuine, not just marketing language.
How Passkeys Actually Work, Without the Jargon
When you create a passkey for an account, your phone generates two mathematically linked keys: a private key that never leaves your device, and a public key that gets sent to the service you’re signing into.
When you log in later, the service sends a challenge, and your phone uses the private key to prove it has the matching key, without ever sending the private key itself anywhere. This is confirmed locally on your phone using your fingerprint, face unlock, or screen lock PIN.
Because the private key never leaves your device, there’s nothing for a phishing site to steal even if you’re tricked into visiting one. A fake login page can ask you for a password and get something usable; it can’t extract a passkey the same way, since the cryptographic proof only works for the genuine service the passkey was created for.
Set Up Google Password Manager as Your Passkey Storage
Passkeys need to be stored somewhere secure and synced across your devices. On Android, Google Password Manager handles this by default.
- Go to Settings, then Google, then Password Manager.
- Confirm you’re signed into your Google account and that Password Manager is set as your default for passkey storage.
- Passkeys you create going forward sync automatically to any device signed into the same Google account.
This means a passkey created on your phone also becomes usable on a signed-in Chrome browser on your computer, without needing to set anything up separately on each device.
Creating a Passkey for a Specific Account
The exact steps vary slightly by service, but the general flow is consistent across most apps and websites that support passkeys.
- Go to the account or security settings within the app or website, look specifically for “Passkeys,” “Security Keys,” or “Sign-in options.”
- Select the option to create or add a passkey.
- Your phone will prompt you to confirm with your fingerprint, face, or screen lock PIN.
- The passkey is created and saved to Google Password Manager automatically.
Major services with passkey support as of writing include Google itself, Amazon, PayPal, Microsoft accounts, WhatsApp, and a growing list of others, though support genuinely varies by service, so check the specific account’s security settings directly.
Setting Up a Passkey for Your Google Account Specifically
Since your Google account is the foundation everything else depends on for passkey sync, it’s worth setting one up here first, before other accounts.
- Go to myaccount.google.com, then Security.
- Find “Passkeys and security keys” under How you sign in to Google.
- Tap Create a passkey, then confirm with your fingerprint, face, or PIN.
Google also offers the option to skip passwords entirely for your account after this, making the passkey your primary sign-in method rather than an alternative alongside your password.
What to Do If a Service’s Passkey Option Doesn’t Appear on Your Phone
Occasionally a service that supports passkeys shows the option on a computer but not within its Android app, since mobile support sometimes lags behind web support even for the same company. Checking that specific service’s app is fully updated to its latest version is the first thing worth confirming.
If it’s updated and the option still doesn’t appear, trying the account’s settings through a mobile browser rather than the dedicated app sometimes surfaces the passkey option where the app hasn’t caught up yet, since the underlying web implementation is often ahead of app-specific rollouts.
Passkeys and Shared or Family Accounts
For accounts genuinely shared between multiple people, a family streaming account, for instance, passkeys work slightly differently than for a personal account, since each family member’s device would need its own passkey registered separately rather than sharing one set of credentials.
Most services handle this by allowing multiple passkeys registered to the same account, one per family member’s device, similar to how you might register multiple trusted devices today. Check the specific service’s account security settings for whether it supports multiple passkeys per account before assuming this will work the same way as a single-user account.
Using a Passkey to Sign In
Once created, signing in becomes noticeably simpler than typing a password. On the login screen, you’ll typically see a passkey option, either automatically suggested or selectable, and confirming with your fingerprint or face unlock completes the sign-in immediately.
There’s no password field to type into at all for that account going forward, though most services keep the password as a fallback option unless you specifically remove it, covered later in this guide.
Passkeys Across Devices You Don’t Own
If you need to sign into an account on a device that isn’t yours, a friend’s computer, a library computer, passkeys handle this through a QR code flow rather than leaving you locked out.
The unfamiliar device shows a QR code on its login screen. Scanning it with your phone, then confirming with your fingerprint or face, completes a secure sign-in without ever exposing your passkey to the device you’re borrowing, which is genuinely more secure than typing a password into a computer you don’t control and trust.
What Happens If You Lose Your Phone
This is the most common concern people raise, and it’s a reasonable one. Since passkeys sync through Google Password Manager tied to your Google account, recovering access on a new phone starts with signing into that same Google account.
Once signed in on the replacement device, your saved passkeys become available there too, provided you can still access your Google account itself, which is why securing your Google account specifically with strong recovery options, a recovery phone number and email, and ideally its own passkey, matters as the foundation everything else builds on.
Removing a Passkey You No Longer Need
If you’ve set up a passkey on a device you’re getting rid of, or simply want to remove one for a specific account, this is handled through that service’s own account security settings, not through a general Android system menu.
- Go to the specific service’s security or sign-in settings.
- Find the Passkeys section, which typically lists each registered passkey by the device name it was created on.
- Select the specific passkey and remove it.
This doesn’t affect passkeys for other accounts, since each service manages its own list of registered passkeys independently. Removing one from your old phone, once you’ve confirmed the new phone has its own working passkey, is good practice before recycling or selling the old device.
Why Passkeys Are Considered Resistant to the Attacks That Bypass Traditional 2FA
Sophisticated phishing attacks have evolved specific techniques to defeat traditional two-factor authentication, relaying both a stolen password and a real-time 2FA code through a fake login page positioned between you and the real service. This is called an adversary-in-the-middle attack, and it’s become increasingly common against high-value targets.
Passkeys are specifically designed to resist this exact attack, since the cryptographic exchange is bound to the specific domain the passkey was created for. A fake phishing site, even one convincingly relaying your input to a real login page in real time, simply cannot complete a passkey exchange, since the passkey checks that it’s talking to the genuine service’s actual domain before responding at all.
Frequently Asked Questions
Do I need to delete my password after setting up a passkey?
Not necessarily, most services let both exist simultaneously as sign-in options. Removing the password entirely, where the service allows it, does close off phishing risk targeting that password specifically, but it’s optional and worth doing gradually as you confirm passkey sign-in works reliably.
Can someone unlock my passkeys if they steal my phone?
Only if they can also unlock your phone itself, since passkey use requires your fingerprint, face, or screen lock PIN each time. This is why having a strong screen lock, not just relying on passkeys existing, remains genuinely important.
Do passkeys work without an internet connection?
The cryptographic confirmation itself happens locally on your device, but you still need internet access to actually reach the service you’re signing into, the same as with a password.
How Passkey Sync Actually Travels Between Your Devices
It’s worth understanding what actually happens technically when a passkey syncs across devices, since it’s not simply copying a file between them the way syncing a document would work. Google Password Manager encrypts your passkeys before they leave your device, and this encryption is tied to your Google account credentials.
This means Google itself cannot read your private keys even though it’s facilitating the sync between your devices, since the encryption happens client-side before anything is transmitted. This is a meaningful distinction from older password sync systems, where the storing service technically could access stored credentials if their own security were compromised.
What Happens to Passkeys on a Factory Reset
If you factory reset your phone, passkeys stored in Google Password Manager aren’t lost, since they’re tied to your Google account rather than the physical device. Signing back into the same account after the reset restores access to your saved passkeys automatically.
This is genuinely different from how passkeys work on some other platforms that tie storage more tightly to a specific device’s hardware security module, and it’s one of the advantages of Google’s approach specifically for Android users who change or reset devices relatively often.
Enterprise and Work Account Considerations
If your phone has a work profile managed by your employer’s IT department, passkey behavior for work accounts specifically may follow different rules set by your organization’s security policy, separate from personal account passkeys covered throughout this guide.
Some organizations require passkeys be tied to a hardware security key rather than synced through a consumer password manager, for compliance reasons specific to their industry. If you’re setting up a passkey for a work account and it behaves differently than expected, checking with your IT department rather than assuming a general troubleshooting step applies is the right move.
Frequently Asked Questions, Continued
Can I have multiple passkeys for the same account on different devices?
Yes, though with Google Password Manager’s sync, you often don’t need separate ones, since one passkey created on your phone becomes usable across every device signed into the same Google account. Some people still create device-specific passkeys deliberately for accounts they want to limit to a single trusted device.
Does using a passkey mean I can never see or export my sign-in credential?
Correct, and this is intentional rather than a limitation, since the private key is specifically designed never to be exportable or viewable, which is exactly what prevents it from being stolen or phished the way a visible password can be.
Passkeys Versus Two-Factor Authentication: Understanding the Difference
It’s worth being clear that passkeys aren’t the same thing as two-factor authentication, even though both improve security beyond a plain password. Two-factor authentication adds a second step on top of a password, typically a code from an authenticator app or text message.
A passkey replaces the password step entirely with something inherently stronger, since it can’t be phished the way a password and even a 2FA code technically can be, through sophisticated real-time phishing attacks that relay both the password and the code. Many services still let you layer additional security on top of a passkey for particularly sensitive accounts, but a passkey alone is already meaningfully stronger than a password plus traditional 2FA against most real-world attacks.
Why Some Services Still Don’t Support Passkeys
Passkey adoption has grown quickly among large tech companies and major financial services, but plenty of smaller services, older enterprise systems, and niche apps haven’t implemented support yet, since it requires backend changes on the service’s own side, not just something you can enable unilaterally.
For accounts that don’t support passkeys yet, continuing to use a strong, unique password managed through Google Password Manager or another password manager, combined with two-factor authentication where offered, remains the practical approach until that specific service adds passkey support.
What Happens When You Switch Password Manager Providers
If you use a third-party password manager, like Bitwarden or 1Password, instead of relying on Google Password Manager as your default, many of these now support storing passkeys too, and you can set your preferred password manager as the system default for passkey creation instead.
Go to Settings, then Passwords, Passkeys & Accounts, or a similarly worded settings screen depending on your Android version, and select your preferred password manager as the default credential manager, rather than Google Password Manager, if you’d rather keep everything centralized in a different app you already use.
Do all Android phones support passkeys equally, or does this vary by manufacturer?
Passkey support is built into Android itself starting with Android 9 for the underlying framework, though the smoothest experience is on Android 14 and later, where it’s more deeply integrated into the system-wide credential manager rather than requiring app-specific implementations. Older phones can still use passkeys through supporting apps, just with a slightly less unified experience across the system.
What happens if I try to use a passkey on a phone that isn’t signed into my Google account?
The passkey simply won’t be available, since it’s tied to your account in Password Manager rather than stored locally in a way an unrelated device could access. This is intentional and part of what makes passkeys secure even if a device is lost or stolen without being unlocked.
Should I still write down or store a backup of my passkeys somewhere separately?
Not in the traditional sense of writing down a password, since a passkey genuinely can’t be exported or written down as a usable code. The real safeguard is making sure your Google account itself has strong recovery options set up, since that account is what everything else depends on for access.
Conclusion
Passkeys close a real security gap that passwords, even strong ones, inherently have: they can’t be phished the way a typed password can, since there’s no shared secret that ever leaves your device.
Setting one up takes a couple of minutes per account, starting with the accounts that matter most, your Google account, email, and financial services. As more services adopt support, gradually moving your most important accounts over is worth doing rather than waiting for every single service to catch up first.
Since a passkey is specifically designed to resist the same phishing tricks that have started defeating traditional two-factor codes, this is a genuine security upgrade, not just a convenience feature dressed up as one.
If you think there’s been a mistake here, please do let us know by commenting on this post or Contact Us. And a member of our Content Integrity Team will review this decision with you.
