> ## Content Index > Fetch the complete content index at: https://www.skimwire.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to set up passkeys on iPhone, Android and Windows (and never get locked out) - URL: https://www.skimwire.com/how-to-set-up-passkeys-iphone-android-windows/ - Published: 2026-10-24T16:09:50.000Z - Updated: 2026-10-24T16:09:50.000Z - Description: Passkeys replace passwords and can't be phished. Step-by-step setup for iPhone, Google and Windows, plus backups and switching managers. - Author: Jeremy Moon - Tags: Guides, Security, Apps ## The skim - **A passkey replaces your password** with a key that's stored on your phone, computer or password manager. You unlock it with your face, fingerprint or device PIN. - **Passkeys can't be phished.** Each one is tied to the real website it was made for, so a fake look-alike site can't use it. There's also nothing to reuse, leak or type into a scam page. - **Start with your most important accounts:** your Google, Apple and Microsoft accounts, then your password manager, email, bank and shopping accounts. - **Pick one place to keep them,** such as iCloud Keychain, Google Password Manager or a manager like 1Password or Bitwarden. Then always have a backup way in: a second device or a hardware security key. - **Switching managers is now possible.** On iOS 26, and on Android 14 or later with an up-to-date Google Play Services, passkeys can move between compatible managers through an encrypted transfer. *Steps checked against Apple, Google, Microsoft and FIDO Alliance-member documentation on Oct. 24, 2026\. Menus vary by app and version. Skimwire may earn a commission from links in this guide. As an Amazon Associate, Skimwire earns from qualifying purchases. That never decides what we recommend.* ## What is a passkey? A passkey is a sign-in method built on a public industry standard (FIDO2/WebAuthn) that Apple, Google and Microsoft all support. When you create one, your device makes **two linked keys**. The **private key** stays on your device or in your password manager. The **public key** goes to the website. When you sign in, your device uses the private key to answer a one-time challenge from the site, and the site checks the answer with the public key. [Microsoft's explainer](https://support.microsoft.com/en-us/windows/passkeys-in-windows-301c8944-5ea2-452b-9886-97e4d2ef4422?ref=skimwire.com) walks through it in plain terms. Why that matters: - **There's no secret for a website to leak.** A breached site holds only public keys, which are useless to an attacker. - **Phishing doesn't work.** A passkey made for netflix.com only works on netflix.com. Your device won't offer it to a look-alike site. - **Your face or fingerprint never leaves your device.** It only unlocks the passkey on your device. Google and Microsoft both say biometric data isn't sent to them. - **It counts as two factors.** You need the device (something you have) and your face, fingerprint or PIN (something you are or know). ## Before you start: pick where your passkeys will live A passkey is saved in a **credential manager**. Pick one and stick with it, so your passkeys follow you to every device. | If you use… | Good default home for passkeys | Syncs to | | ------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------ | | iPhone, iPad and Mac only | Apple Passwords (iCloud Keychain) | Your Apple devices signed in to the same Apple Account | | Android and Chrome | Google Password Manager | Android devices and Chrome where you're signed in to Google | | Windows and Edge | Microsoft Password Manager (Edge 142 or later, personal profile) | Your devices signed in to the same Microsoft account | | A mix of all three | A cross-platform manager such as 1Password, Bitwarden or Dashlane | iPhone, Android, Windows and Mac through the manager's app and extension | **Minimum requirements**, according to [Google](https://support.google.com/accounts/answer/13548313?hl=en&ref=skimwire.com) and [Microsoft](https://support.microsoft.com/en-us/windows/passkeys-in-windows-301c8944-5ea2-452b-9886-97e4d2ef4422?ref=skimwire.com): Windows 10, macOS Ventura, ChromeOS 109, iOS 16 or Android 9 or later, and a current browser (Chrome, Edge 109+, Safari 16+, Firefox 122+). Turn on your device's screen lock. On Apple devices, iCloud Keychain and two-factor authentication must be on. ## How to set up a passkey on iPhone, iPad or Mac From [Apple's iPhone User Guide](https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-websites-and-apps-iphf538ea8d0/ios?ref=skimwire.com): 1. Sign in to the website or app with your password as usual, then open its **account or security settings**. (For a new account, choose the sign-up option.) 2. When you see the option to **create or save a passkey**, tap **Continue**. 3. Confirm with Face ID, Touch ID or your passcode. The passkey is saved in the **Passwords** app and syncs through iCloud Keychain. **Signing in:** tap the username field, pick the suggested account and confirm with Face ID or Touch ID. **On someone else's computer:** choose "Other options" or "Passkey from nearby device" on the sign-in screen, then scan the QR code with your iPhone camera. To save passkeys to 1Password, Bitwarden or another manager instead, install it and turn it on under **Settings › General › AutoFill & Passwords**, then pick it when you're asked where to save. ## How to add a passkey to your Google account (Android or any device) 1. Go to [myaccount.google.com/signinoptions/passkeys](https://myaccount.google.com/signinoptions/passkeys?ref=skimwire.com) and verify it's you. 2. Choose **Create a passkey** and follow the prompts. Your phone's screen lock (fingerprint, face or PIN) protects it. 3. Next time you sign in, enter your username and approve with your screen lock. On a computer, choose **Try another way › Use your passkey** and scan the QR code with your phone (Bluetooth must be on). Things [Google's help page](https://support.google.com/accounts/answer/13548313?hl=en&ref=skimwire.com) points out: - **Only create passkeys on devices you own.** Anyone who can unlock that device can get into your Google account. - **A passkey skips your 2-Step Verification code,** because using the device already proves it's you. - **A new passkey can take up to 7 days** before it's offered at sign-in. - **If you'd rather enter your password first,** turn off **Skip password when possible** under Security & sign-in. - **Lost a device?** Sign it out under **Security & sign-in › Your devices**. ## How to use passkeys on Windows and with a Microsoft account On Windows 11, a passkey is unlocked with **Windows Hello**: your PIN, fingerprint or face. To add one to your Microsoft account, accept the "Sign in faster with your face, fingerprint or PIN" prompt when you sign in, or add a passkey from your account's security settings. Microsoft's [passkey guide](https://support.microsoft.com/en-us/windows/passkeys-in-windows-301c8944-5ea2-452b-9886-97e4d2ef4422?ref=skimwire.com) has the details. On other sites, accept the "Create a passkey?" prompt. Microsoft recommends saving passkeys to a **synced** manager so they reach your other devices. If you keep a passkey only on one PC (a "device-bound" passkey), create passkeys on your other devices too, as spare keys. Work or school PCs may restrict these options. ## Don't get locked out: set up a backup - **Keep two ways in for every important account.** That could be a passkey on your phone and one on your laptop, or a synced manager plus a hardware key. Adding a passkey doesn't remove your password or recovery options, so check those are still up to date. - **Protect the account that syncs everything.** Your Apple Account, Google account or password manager is now the key to every other key, so use a strong account password and up-to-date recovery options. - **Think about a hardware security key** for your most valuable accounts (email, password manager, bank). It's a small USB-C/NFC key that stores passkeys offline. Register two keys, one to carry and one to keep at home as a spare. ![A Yubico security key being tapped against the back of a phone to sign in](https://storage.ghost.io/c/1b/e0/1be0a33a-49c9-4654-bd16-97fdc92be59d/content/images/2026/10/yubico-inline-1.jpg) Image: Yubico **Two good keys** (prices from [Yubico's store](https://www.yubico.com/product/security-key-series/security-key-c-nfc-by-yubico-black/?ref=skimwire.com), checked Oct. 24, 2026): - **Yubico Security Key C NFC, $29.** It supports FIDO2/WebAuthn and U2F only, which is all most people need for passkeys. It stores up to 100 passkeys, works over USB-C or by tapping it on an NFC phone, and is rated IP68\. [Yubico Security Key C NFC on Amazon](https://www.amazon.com/dp/B0BVNRXFHT?tag=techtalkwithj-20&ref=skimwire.com). - **YubiKey 5C NFC, $58.** It adds one-time codes (OTP and OATH), smart card (PIV) and OpenPGP for work and developer setups, and also stores up to 100 passkeys. [YubiKey 5C NFC on Amazon](https://www.amazon.com/dp/B08DHL1YDL?tag=techtalkwithj-20&ref=skimwire.com). ## How to move passkeys to a different password manager Moving passkeys used to mean starting over. The FIDO Alliance's new **Credential Exchange Protocol (CXP)** now lets you move passwords and passkeys between compatible managers in an encrypted transfer, with no plain-text export file. Its backers include Apple, Google, Microsoft, 1Password, Bitwarden, Dashlane, NordPass and Samsung. - **On iPhone (iOS 26 or later):** start in the app you're leaving and choose **Export Data to Another App** or similar. Apple [introduced](https://developer.apple.com/videos/play/wwdc2025/279/?ref=skimwire.com) this in the Passwords app. - **On Android (Android 14 or later, Google Play Services 26.21 or later):** start the *import* from the app you're moving to. [Bitwarden says](https://bitwarden.com/blog/security-vendors-join-forces-to-make-passkeys-more-portable-for-everyone/?ref=skimwire.com) Android support arrived in July 2026. - **A few passkeys can't move.** According to Bitwarden, passkeys that use a hidden security counter can't be transferred. Re-create those on the new manager. ## Key facts ### Are passkeys safer than passwords? Yes. A passkey can't be phished, guessed or reused, and websites store only a public key, which is useless if the site is breached. Microsoft counts a passkey as multi-factor authentication. ### What happens if I lose my phone? If your passkeys are synced (iCloud Keychain, Google Password Manager or a password manager), they're on your other devices and come back when you sign in on a new phone. Remove the lost device from your account. Passkeys kept only on one device are lost with it, which is why you need a backup. ### Can I use a passkey on someone else's computer? Yes. Choose the option to use a passkey from a nearby device, then scan the QR code with your phone. Bluetooth confirms that your phone is actually nearby. ### Do passkeys work across iPhone, Android and Windows? Yes. They're an open standard, and you can sign in on one platform with a passkey from another by scanning a QR code. For everyday syncing across all three, use a cross-platform manager such as 1Password or Bitwarden. ### Does a passkey replace my password completely? Not always. Many sites keep your password as a fallback, and adding a passkey to a Google account doesn't remove your existing sign-in or recovery methods. Keep a strong, unique password in your manager for those accounts. ### Do I need a hardware security key? Most people don't. Phone and password-manager passkeys are enough. A key like the $29 Yubico Security Key C NFC is a cheap, offline backup for your email, password manager and financial accounts. ## Sources - Apple: [Use passkeys to sign in on iPhone](https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-websites-and-apps-iphf538ea8d0/ios?ref=skimwire.com); [What's new in passkeys (WWDC25)](https://developer.apple.com/videos/play/wwdc2025/279/?ref=skimwire.com) - Google: [Sign in with a passkey instead of a password](https://support.google.com/accounts/answer/13548313?hl=en&ref=skimwire.com) - Microsoft: [What are passkeys and why they matter](https://support.microsoft.com/en-us/windows/passkeys-in-windows-301c8944-5ea2-452b-9886-97e4d2ef4422?ref=skimwire.com) - Bitwarden: [Credential Exchange Protocol on iOS and Android](https://bitwarden.com/blog/security-vendors-join-forces-to-make-passkeys-more-portable-for-everyone/?ref=skimwire.com) (updated July 23, 2026) - Yubico: [Security Key C NFC](https://www.yubico.com/product/security-key-series/security-key-c-nfc-by-yubico-black/?ref=skimwire.com) and [YubiKey 5C NFC](https://www.yubico.com/product/yubikey-5-series/yubikey-5c-nfc/?ref=skimwire.com) specs and prices *Related on Skimwire:* [*1Password now lets AI agents sign in without seeing your passwords*](https://www.skimwire.com/1password-for-agents-ai-agents-sign-in-without-passwords/) *·* [*Railway breach: rotate your keys*](https://www.skimwire.com/railway-breach-customer-secrets-rotate-keys/) *·* [*Best Bluetooth trackers in 2026*](https://www.skimwire.com/best-bluetooth-trackers-2026-airtag-smarttag-moto-tag/)