Passkeys on major services: step-by-step

by

In today’s increasingly digital world, security has become a paramount concern for users and service providers alike. With cyber threats evolving, major technology companies are moving beyond traditional passwords to more secure alternatives. Passkeys — a form of passwordless authentication — offer enhanced security, ease of use, and resilience against phishing. In this guide, we provide a step-by-step overview of how to enable and use passkeys across major services such as Google, Apple, and Microsoft.

What Are Passkeys?

At a technical level, a passkey is a type of cryptographic credential based on public-key authentication. Instead of relying on text-based passwords, passkeys use a private key (stored securely on your device) and a public key (stored by the service). When you log in, authentication happens through this key pairing, removing the need for a password entirely.

The result? A more secure and user-friendly experience, resistant to phishing and credential stuffing attacks.

Why Passkeys Are More Secure

  • Phishing resistance: Since users don’t type anything, they can’t be tricked into entering credentials into a fake site.
  • Unique per service: Passkeys are unique to each website or application and can’t be reused across services.
  • Encrypted storage: The private keys never leave your device and are stored securely with encryption.
  • Multi-device sync: On modern operating systems, passkeys can sync across devices using keychain services.

Getting Started with Passkeys

Most passkeys work with facial recognition, fingerprint, or a trusted device confirmation. Here’s how to enable and manage passkeys with major service providers.

1. Google

Google has widely adopted passkeys starting in 2023 and allows you to use them to sign into your Google Account on supported devices.

  1. Visit the Google Passkeys page: Go to g.co/passkeys
  2. Sign into your account: Use your existing credentials to access your account settings.
  3. Add a passkey:
    • Click on “Create a Passkey.”
    • Confirm identity using biometric security or device PIN.
  4. Device registration: Google will list your current device as registered for passkeys. The passkey is then ready to use.

After setup, the next time you log into your Google Account, you’ll be prompted to authenticate using the passkey — typically with biometrics.

2. Apple (iCloud and Safari)

Apple introduced passkey support in iOS 16, iPadOS 16, and macOS Ventura. If you operate within the Apple ecosystem, the process is streamlined, and your passkeys sync across devices via iCloud Keychain.

  1. Set up iCloud Keychain:
    • Navigate to Settings > Your Name > iCloud > Passwords and Keychain.
    • Make sure iCloud Keychain is turned on.
  2. Visit a passkey-supported website or app (e.g., Best Buy, Google, PayPal).
  3. Create a Passkey: When prompted to create a passkey:
    • Use Face ID or Touch ID to confirm.
  4. Auto-saving: The passkey is saved in the Keychain and available on all your Apple devices.

To check or export/delete passkeys, go to Settings > Passwords on iOS or System Settings > Passwords on macOS.

3. Microsoft

Microsoft has joined the passkey initiative via Windows Hello and Edge browser support in Windows 11.

  1. Enable Windows Hello:
    • Go to Settings > Accounts > Sign-in options.
    • Set up a PIN, Face Recognition, or Fingerprint, if not already done.
  2. Visit Microsoft Passkeys page (in development phase but expanding):
    • Try enabling passkeys on supported services like Outlook.com or Microsoft 365.
  3. Create a passkey using on-screen instructions:
    • You’ll be asked to authenticate using Windows Hello methods.

Note: Full native passkey account-based login with Microsoft is still expanding, but device-based authentication offers strong security today.

Using Passkeys on Third-Party Sites

Many large platforms like Amazon, GitHub, Dropbox, and PayPal are rolling out passkey support. The steps are largely the same:

  1. Go to the account security page of the service.
  2. Look for an option like “Add a passkey” or “Enable passwordless sign-in.”
  3. Confirm using your device’s biometric or PIN.

Ensure your browser supports passkey login (Safari, Chrome, Edge on modern OS). Sites using FIDO2/WebAuthn trigger device-based authentication requests.

Cross-Platform Syncing and Backup

A key feature of passkeys is syncing across your devices. Here’s how major platforms handle this:

  • Apple: Uses iCloud Keychain to sync passkeys across iOS, macOS, and iPadOS via encrypted storage.
  • Google: Syncs via Google Password Manager if you’re signed into your Google Account and backup enabled.
  • Microsoft: Windows Hello synchronizes across devices signed in with the same Microsoft account (requires Windows 11 and BitLocker enabled).

Passkey Best Practices

To maximize security and convenience when using passkeys, keep these recommendations in mind:

  • Use modern hardware with biometric sensors or TPM (Trusted Platform Module) support.
  • Keep operating systems updated to benefit from the latest passkey features.
  • Set up device backup in case your phone or computer is lost — otherwise, your passkeys could become inaccessible.
  • Use strong OS/device PINs as fallback options.

What Happens If You Lose Your Device?

If your device is lost or stolen, your passkeys are protected by the underlying biometric, PIN, and encryption mechanisms. However, recovery may vary:

  • Apple: Restore from iCloud Keychain backup onto a new device using your Apple ID.
  • Google: Use Google Account credentials or backup device to access stored passkeys.
  • Microsoft: Set up Windows Hello on a new device and re-register passkeys on supported services.

Passkeys and Multi-Factor Authentication (MFA)

While passkeys can serve as a single factor that’s resistant to phishing, some organizations and services may use them as part of a broader multi-factor authentication (MFA) approach — especially in enterprise contexts. Don’t be surprised if passkeys are combined with additional authentication in high-risk scenarios.

Conclusion

Passkeys represent a significant leap forward in security and user convenience. Supported by major platforms like Apple, Google, and Microsoft, passkeys are designed to eliminate passwords while maintaining maximum security. Though adoption is ongoing, hundreds of services are already implementing passkey login, making now a great time to transition.

By following the steps outlined in this guide, you can safeguard your accounts with cutting-edge technology — all while enjoying a password-free future.