Passkeys explained: how they replace passwords on Android and Windows

Passkeys let you sign in with a fingerprint, face scan or PIN instead of a password, and every major platform now supports them. Here is how they work, how to start using them and where Hide Expert VPN adds protection.

Passkeys on Android and Windows: how support grew

In mid-2023, passkeys took two notable steps forward. First, a third-party password manager announced passkey support for Android 14. Until then, people on Android 9 to Android 13 could manage passkeys only through Google Password Manager, while Android 14 lets users choose another app as their passkey provider. Other password managers rolled out or tested passkey support around the same time.

Second, Google brought biometric authentication in Google Password Manager to Windows PCs, adding to its existing support on Android and iOS. Depending on the computer's hardware, users can verify themselves with a fingerprint or a face scan.

Behind these updates, Apple, Microsoft and Google joined forces to support the passwordless sign-in standards created by the FIDO Alliance and the World Wide Web Consortium (W3C). A FIDO Alliance report from May 2023 found that 58% of U.S. consumers were interested in passwordless technology, and 47% had some familiarity with passkeys.

How passkeys work

A passkey is a pair of cryptographic keys. When you create one for a website or app, your device generates:

• a private key, which stays on your device or in your password manager and is never sent to the website;
• a public key, which the website stores.

When you sign in, the site sends a challenge, your device signs it with the private key, and the site checks the signature with the public key. You unlock the private key with your fingerprint, face or screen lock PIN, and your biometric data stays on the device – the website never receives it.

This design solves several password problems at once. There is nothing to reuse, nothing to forget and nothing useful for attackers to steal in a server breach, because a public key alone cannot sign anyone in.

Why passkeys are safer than passwords

• They resist phishing. A passkey is tied to the real website's domain, so it will not work on a lookalike page.
• They cannot be guessed. Weak passwords fall quickly to modern guessing tools, as our guide to passwords that resist AI guessing shows, but a passkey has no secret for anyone to guess.
• They combine two factors in one step. You need your device, plus your biometrics or PIN to unlock it.

The move away from passwords did not happen overnight. It grew out of a long debate on whether passwords are still fit for purpose, and passkeys are one of the clearest answers to it.

How to start using passkeys

1. Choose where your passkeys will live. On iPhone and Mac they are saved in iCloud Keychain and, in recent versions, shown in Apple's Passwords app; on Android, in Google Password Manager or another provider you select; and on Windows, they are protected by Windows Hello. Many third-party password managers also store passkeys and sync them between devices.
2. On Android, pick your provider. In the passwords and accounts section of Settings, choose which service should save passkeys and fill in sign-ins. If you already keep passwords in Google's manager, our guide on saving passwords on Android shows how to find them.
3. Create a passkey for an account. On a site that supports passkeys, open the account's security settings and look for an option to create or add a passkey. Confirm with your fingerprint, face or PIN.
4. Sign in on other devices. If your passkey is on your phone, many sites let you sign in on a computer by scanning a QR code with that phone.
5. Keep a backup way in. Make sure your recovery email, phone number or backup codes are up to date in case you lose your device.

Limits to keep in mind

Not every site supports passkeys yet, so you will still need passwords for some accounts – and those should be unique and stored in a password manager. Moving passkeys between providers has also been harder than moving passwords, so choose your main provider before creating dozens of them.

For accounts that still rely on passwords, keep two-factor authentication switched on – it remains one of the simplest defenses against stolen credentials.

Passkeys protect the moment you sign in, not the connection you use afterward. On public Wi-Fi, a VPN such as Hide Expert encrypts the traffic between your device and the VPN server, which complements passkeys rather than replacing them.

FAQ

Are passkeys safe if my phone is stolen?

A thief would still need your fingerprint, face or device PIN to use them. Protect your phone with a strong screen lock and turn on its remote lock and erase features.

Can I use passkeys and passwords together?

Yes. Many sites that support passkeys keep the password as a fallback, so you can switch gradually.

Conclusion

Passkeys replace secrets you have to remember with keys your devices manage for you. Support is now widespread on Android, Windows, iPhone and Mac, so start with your most important accounts – email, banking and cloud storage – and add others as more sites adopt them.