Passkeys explained: signing in to your financial accounts without a password

What a passkey is

When you create a passkey for a website, your device generates a matched pair of keys. One half, the public key, is sent to the website. The other half, the private key, stays on your device or in your password manager and is never sent anywhere.

To sign in, the website sends a one-time challenge. Your device asks you to unlock it with your fingerprint, face or PIN, then uses the private key to answer the challenge. The website checks the answer against the public key it holds. No secret crosses the internet, and there is nothing for you to type.

Why it cannot be phished

A password works on any page you type it into, including a convincing fake. A passkey is tied to the real website's address. If you land on a look-alike page, your device finds no passkey for that address and offers nothing. You do not have to spot the fake; the passkey simply does not work there.

This is the big difference from one-time codes, which a scammer can ask you to read out or type into a fake page.

Why a breach does not expose it

When a company that stores passwords is breached, attackers try the stolen passwords everywhere else, which is how one leak becomes many break-ins. A company that stores passkeys holds only public keys. Those are useless for signing in, on that site or any other, so there is nothing worth stealing.

What about your fingerprint?

Your fingerprint or face never leaves your device and is never sent to the website. It only unlocks the private key locally, the same way it unlocks your phone. The website learns that you passed the check, not what your fingerprint looks like.

If you lose your phone

Most passkeys today are synced. Apple, Google and the major password managers keep an encrypted copy and make it available on your other devices, so a new phone signed in to the same account gets your passkeys back.

That makes the account that syncs them very important. Protect it with a strong, unique password and two-factor authentication, and make sure you know its recovery options.

• Keep a second way in for important accounts: a passkey on another device, or an authenticator app.
• Do not remove your old sign-in method until you have confirmed the passkey works on a second device.
• If a phone is lost, sign in to the syncing account from another device and remove the lost phone from it.

Where passkeys fall short today

• Not every bank offers them yet, and some offer them only in their mobile app.
• Moving passkeys between ecosystems, for example from one phone maker to another, is still awkward. A cross-platform password manager avoids the problem.
• On a shared family computer, a passkey saved to that computer can be used by anyone who can unlock it.
• Many services keep the password as a fallback, so the account is only as strong as that fallback until you secure it too.

How to start

Begin with the accounts that matter most and already support passkeys: your email, then financial accounts as they add support. Look under security or sign-in settings for 'passkey' and follow the prompt. It takes under a minute.

My AI Fin App supports passkeys alongside Google, Apple and password sign-in, and signing in with one counts as your second factor.