Passwords can be difficult to remember, and can be difficult to avoid accidentally re-using or entering them onto a fake website. Even if you have a strong password, it can still be compromised through phishing. More websites and apps now offer passkeys which simplify the sign-in process.
To get started, you don’t need to change all your accounts at once. Just take your time to start with something important, understand how they work, and have a secure back-up in place.
What Are Passkeys?
Passkeys are a cryptographic authentication method. Usually they use biometric data like fingerprints or facial recognition, along with a PIN or password on your device screen lock to verify your identity.
They use a pair of related keys. One private key (kept secure by your device or credential provider) and one public key (stored by the website/app). The private key doesn’t get sent anywhere when you log-in so they’re much more secure from phishing.
Biometric data like your fingerprint or facial recognition doesn’t get sent to the websites either. Instead you use your regular device screen lock to verify.
Passkeys Vs Passwords – What’s The Difference?
Instead of having to enter in a password (which you could be tricked into revealing to a criminal), your device proves to the website that you have the right credentials.
Advantages of using passkeys include:
- No need to remember long passwords for supported sites.
- Better protection from phishing as they’re linked to the site/app they were created for.
- Faster access as you’ll likely be able to use your device screen lock.
- Less chance of re-using passwords as each account has a unique set of credentials.
However, it’s not fool-proof. If someone has access to your unlocked device or can exploit the recovery option it could still cause problems.
Getting Started With Passkeys
Take a few minutes to ensure you’re set up and ready.
- Ensure you have the latest updates for your device and browser. Passkeys work best with updated software.
- Ensure you have a screen lock on your device. Have a strong PIN/password and optionally biometrics.
- Decide where you’d like to store your passkeys. They may be stored on your phone’s built-in credential manager or compatible password manager and will be synced across your supported devices.
- Ensure you have your main device account secure. This could be your Apple, Google, Microsoft or password manager account which may help you to access your synced passkeys.
- Ensure your account recovery options are up-to-date. Store any recovery codes securely.
Do not store your personal passkeys on someone else’s account if you’re sharing a computer.
How To Set Up Passkeys
This may vary slightly for each service but the process is generally quite similar.
1. Open the Official Site/App
Log-in to your account. If you’re using a service like your email or shopping account open the site/app directly.
2. Access Security/Sign-in Options
Go to your account settings and look for a section called Security, Sign-in Methods, Passkeys or Passwordless Sign-in. Not all services will support passkeys. The wording may vary.
3. Create Passkey
Choose an option to create a passkey (e.g. Create a passkey, Add passkey). Your device may ask where you’d like to store them and ask you to prove your identity.
4. Verify Using Screen Lock
You’ll be asked to provide fingerprint, facial recognition, PIN or device password. Your device will create the credential and send the public key to the service.
5. Test Your Passkey
Log-out and attempt to log-in again. Select the option to use your passkey and follow the prompts on your device. Ensure you’re able to access your account before making any changes to your current sign-in method.
6. Repeat For Other Key Accounts
Start with your email and any other accounts that support passkeys. Then use them for services you regularly use. Focus on accounts which could expose personal information or payments.
Using Passkeys On iPhone, Android And Computers
On supported iPhone/iPad devices, passkeys can be stored using Apple’s password system. If you’ve enabled the syncing functionality, they’ll be synced across your eligible devices. They’re commonly used with Face ID, Touch ID or passcode.
On Android devices they can be stored in a compatible credential manager. They’re usually verified using your device screen lock. Depending on your set-up, you’ll have different options.
On Windows, Mac and other computers they can be stored locally or in a compatible credential manager. Some websites will allow you to use your phone passkey to log-in to a nearby device. This is commonly done using a QR code and ensuring your device is close by.
Before changing your phone or laptop, check if your passkeys are being synced or if they’re only stored on your old phone.
Can I Remove All Passwords?
Not always. Adding a passkey doesn’t automatically remove your password or disable the password sign-in option. Some providers offer completely password-less accounts but others will still have a password as an alternative or recovery option.
If there’s an option to remove your password, read through the recovery information first. Don’t remove your recovery options or log-out of all your devices until you’ve verified your passkeys are working.
A good aim to have is to use passkeys for everything you can. Any passwords should be unique and strong. If you’re unable to use passkeys, a trusted password manager can help.
What If I Lose My Phone?
If you lose your device, you may be able to still access your passkeys if you’ve synced them with a supported provider. You’ll just need to securely log-in to your new device. However, if they’re linked to your device you may not be able to recover them.
Reduce the chances of being locked out by ensuring your recovery details are up-to-date. If possible add an extra passkey to a second trusted device and store any backup codes securely. If you’re locked out, use the official recovery options from your provider.
Common Mistakes When Using Passkeys
- Assuming all websites support passkeys. Some accounts will still require a password.
- Removing your previous sign-in method too quickly. Ensure you’ve tested your passkey and recovery option.
- Not securing your device. A weak PIN on your screen lock can reduce security.
- Using fake links to set up your passkeys. Always enable passkeys from your account settings.
- Not having any back-up. Ensure you know how you’ll gain access to your account if your device is broken/lost.
Summary
Using passkeys can make daily sign-ins easier and greatly reduce the risk of phishing with passwords. It’s best to start slowly, secure your device and create a passkey for a supported account. Test it and ensure you have recovery options.
You may not be able to get rid of all passwords but every passkey you set up correctly will help you gain secure and easy access.
