In our passkeys versus passwords article we explained the benefits this technology offers in terms of convenience and security.
There’s still a few questions around how passkeys actually work and what happens when you’re dealing with multiple devices.
I’ve rounded up your most common questions around passkeys to help demystify them.
Passkeys FAQ
In simple terms, what is a passkey?
A passkey is a pair of numbers your device creates and stores for an account. Instead of thinking of a password, remembering it, and typing it in, you can simply log in with a device.
Usually, this works with biometrics like a fingerprint or Face ID to prove it’s really you signing in with the device.
How do you create and use a passkey?
Passkey creation happens in a website or app’s account and security settings, or at account creation. Look for “passkey,” “security key,” or “sign in without a password.”
Not every account supports it yet, but most of the important ones have embraced the technology.
Selecting this triggers your device to generate the passkey and confirm it with fingerprint, face scan, or PIN. That’s the entire process.
Using it to sign in is just a matter of tapping the passkey prompt and confirming it.
How do passkeys work if you want to sign in from multiple devices?
Cloud sync handles this if your devices share the same account where the keys are stored. For example, if using Apple ID for your passkeys, signing in works on both an iPhone and Mac.
For other devices that aren’t signed into the passkey account, you can often sign in with other methods like QR code scan or Bluetooth handshake that proves you hold the credential without having to set up the passkey again.
Can you use a passkey across different platforms?
Syncing across platforms like Apple to Windows or PC to Android doesn’t work that easily, but you can still sign in.
When logging in, QR code scan is usually the easiest method for a quick sign-on to a new device.
Alternatively, you could use a cross-platform password manager like Bitwarden or 1Password to store your passkeys instead of an Apple, Google, or Microsoft account. That makes it easy to sync across all kinds of devices.
Can you share passkeys with other people, like to share a family account?
It depends on the ecosystem where your passkeys are stored. Apple explicitly supports this by sharing with trusted contacts, while Google’s family sharing only works with passwords currently.
A shared vault in a password manager like Bitwarden or 1Password is another way to share with family.
If a device is stolen, how do you cancel or block the passkey?
Passkeys are typically locked behind a secondary authentication like fingerprint or face scan, and can’t be used without it, so there’s little to worry about if they’re secured with biometrics.
If the passkey is secured with PIN-only, it’s important to take action to remove its access.
To remove the passkey, go into the account’s security settings and disable the passkey attached to that device. Most account settings provide a list of devices.
It may be worth removing the device from the Apple ID or Google account’s trusted device list too if that’s where your passkeys are stored.
What’s the best way to go about replacing logins with passkeys?
Start with the accounts that matter most, like email accounts, bank accounts, and anything with sensitive info attached to it.
Once you’ve secured the most important and frequently used accounts, just swap them across as you use them when you see the opportunity.
Dealing with every login at once feels like an overwhelming task, but if you’re up for it, a good way might be to check your saved logins in your browser.
Once you’ve upgraded an account with a passkey, it’s usually worth deleting the password as a login option where available, since it’s still a security risk.
How should you consolidate passkeys? What platform should you use?
It’s easiest to use the passkey platform you have with you most of the time; that’s usually your phone.
The worst option would be to scatter them across ecosystem specific vaults like your Microsoft account on PC and Apple or Google on your phone.
For better flexibility, saving passkeys to a manager like Bitwarden makes it easier to sign in on desktop, phone, and tablet.
8 comments
Margaret
Thank you for this article. At 73, I am trying to understand setting up and using passkeys against a user login name and password. On my phone, where I can, I login using biometrics, it is quick and easy. On both my desktop and laptop computers, I use my login name and password with 2 factor turned on for several sites with a code sent to my phone.
My question is, if I set up a passkey, do I have to remember that code? My browser is Firefox and this is synced between devices, including phone. I am a Windows user.
Looking for your advice here, please, with maybe step, by step guides.
Scott Hunt
Hi Margaret,
With a passkey there is nothing to remember. You simply approve the login with your device that stores the passkey.
Brian
Can I use the same passkey for multiple accounts on the same platform like windows 11.
Thank you
Scott Hunt
No, and there is no reason to use the same passkey for multiple accounts.
Eric
I’m still having trouble joining the dots. Perhaps we need a case study or example, in step by step form, to illustrate how to set passkeys up.
In particular, I (and probably many others) would like to see how to set up passkeys across multiple devices. I have a PC, laptop and phone in a Windows 11 and Android environment. Currently I can access apps on any of my devices using one password. Are separate passkeys for each app going to be required on each device?
Thanks for any further light you can shed on this mystery.
Scott Hunt
No, you don’t need to set up a passkey for each device. You set up a passkey on only one of the devices and then use that device to sign in to the account on the other devices.
What this practically looks like is configuring the passkey on, say, your phone. Then, when you want to sign into the account on your PC you could scan a QR code on the PC with your phone and approve the login.
This process differs depending on the website.
Elizabeth
I am currently setting up an estate book to let family know where I have accounts with different companies and where my password book is kept. If I was to use passkeys, how do my family then access accounts to close them up upon my death or incapacitation?
Scott Hunt
Great question, Elizabeth. Each website handles this differently, but common methods to recover an account that’s secured with a passkey include one-time-use recovery codes, a verification code sent to your email address, or other verification like identification documents.