In this article
A passkey lets you sign in with the same face, fingerprint or device unlock you already use for everything else, instead of waiting for a code and typing it in. It is created once, stored by your phone or computer's own password manager, and offered when you next log in.
The security benefit is narrow, specific and larger than it sounds: there is no longer a code for anybody to talk you into reading out.
What you will be able to do
- check_circle Create a passkey and sign in with it.
- check_circle Say exactly which attack it stops.
- check_circle Keep the protections it does not replace.
- check_circle Plan for losing the device it lives on.
Creating one is a single confirmation — the interesting part is what it does and does not cover.
key The attack it removes
Nearly every account taken on this platform is taken the same way. Somebody is contacted by a person who seems plausible, a login is started on the attacker's device, a code arrives, and the code is read out or typed into the wrong place. That is it. No software is broken and nothing is guessed — a person is persuaded to hand over a number.
A passkey removes the number. There is nothing to read aloud, nothing to forward, nothing that can be typed into a convincing imitation of a login screen, because the proof is produced by your device and never leaves it in a form anybody else can use. Against the actual threat, that is a substantial improvement rather than a convenience.
What it does not do is make the account safe from everything, and the rest of this page is about the three protections people assume it has taken over. Keeping them is the difference between a stronger account and a differently shaped weak one.
Four things people think it replaces
It replaces one of them. Knowing which is the whole of this page.
verified_user Replaced — and this is the point
password Not replaced — keep it
phonelink_lock Not replaced — different problem
sim_card Not replaced — still the root
One layer is genuinely improved. The other three are exactly as important as they were yesterday.
key_off What happens when you lose the device
The passkey is kept by your phone or computer's own credential manager, which usually means it is synced with the account behind that device rather than trapped on the handset. That is convenient and it moves a dependency: the security of your messaging account now partly rests on the security of that platform account.
Worth acting on in two ways. Protect that account properly, because it now unlocks more than it used to. And make sure you would still have a route in without it — the phone number, the cloud password, a working recovery address. Every account that becomes unrecoverable does so because somebody removed the old way in before checking the new one covered everything.
If you use a separate hardware key rather than the built-in manager, the same logic applies with sharper edges: the key is a physical object, and a second registered way in is not optional.
settings Setting one up
- Turn on two-step verification first If it is not already on.
- Open the privacy and security settings The passkey option is there.
- Create it and confirm with your device unlock One prompt.
- Check your recovery email still works Before you rely on anything.
- Protect the account that stores it It now unlocks more.
- Decline any prompt you did not start Nobody needs yours.
This page improves the way you sign in. The curriculum step is the layer underneath it: the cloud password, the recovery address, and what actually happens when you are locked out of your own account.
At a glance
- 1Passkey
Sign in with your device instead of a code.
- 2No code to steal
There is no code for anyone to trick you into sharing.
- 3Keep the password
Two-Step Verification still protects your account.
Updated
