Passkeys have moved from "nice idea" to official advice. In April 2026 the UK's National Cyber Security Centre said it will recommend passkeys over passwords wherever a service supports them, and the FIDO Alliance now counts about five billion in use. This guide walks you through creating passkeys for your Google, Apple and Microsoft accounts, then covers using them on a borrowed computer, moving them between managers, and keeping a fallback so you never lock yourself out.
What a passkey is and why it can't be phished
A passkey is a pair of cryptographic keys. The private half stays on your device (or in your password manager's encrypted vault) and the public half is registered with the website. When you sign in, the site sends a challenge, your device signs it after you unlock with Face ID, a fingerprint or your PIN, and the site checks the signature. No secret ever travels over the network.
Two properties make passkeys resistant to phishing. A passkey is bound to the domain it was created for, so a look-alike site at a slightly different address does not match and your device will not offer it. And there is no reusable secret to steal: a stolen database of public keys is useless. The NCSC's passkey explainer describes them as credentials "created and managed for you by your device(s)," which is exactly the point.
For a broader look at how passkeys compare with authenticator apps, SMS codes and hardware keys, see our guide to two-factor authentication methods.
Why now: NCSC's advice and 5 billion passkeys in use
On April 23, 2026 the NCSC announced that it will recommend passkeys wherever they are available, and two-step verification with a strong password where they are not. Its conclusion: passkeys are at least as secure as, and generally more secure than, the strongest password paired with two-step verification. Sign-ins can be up to eight times faster than typing a username, password and code, and Google data cited by the NCSC shows just over 50% of active Google users in the UK have already registered one.
The FIDO Alliance's World Passkey Day report, published May 7, 2026, puts the global figure at roughly five billion passkeys. In its survey of 11,000 consumers across ten countries, 75% had enabled one on at least one account and 49% use them regularly when offered. If you have not set one up yet, you are now in the minority.
Before you begin: choose where your passkeys will live
The single most important decision is which credential manager will store your passkeys, because that determines where they sync and how you recover them. You have three realistic options:
Scroll sideways to see the full table →
| Where the passkey lives | Syncs to | Good for |
|---|---|---|
| Google Password Manager | Android devices and Chrome signed into the same Google account | Android and Chrome users |
| Apple iCloud Keychain (Passwords app) | iPhone, iPad and Mac on the same Apple Account | People mostly inside Apple's ecosystem |
| Third-party manager (1Password, Bitwarden, Proton Pass, etc.) | Every platform the manager supports | Mixed households and people who switch platforms |
Then check the prerequisites:
- A screen lock (PIN, pattern, fingerprint or face unlock) on every device that will hold a passkey.
- On iPhone, iPad and Mac: iCloud Keychain switched on and two-factor authentication enabled for your Apple Account. Apple's passkey guide lists both as requirements.
- Reasonably current software. Google's requirements page lists Android 9 or later, iOS 16 or later, Windows 10 or later, macOS Ventura or later, and Chrome 109, Safari 16, Edge 109 or Firefox 122 or newer.
- Bluetooth enabled if you plan to use a phone's passkey to sign in on a computer.
If you are still choosing a third-party manager, our Bitwarden vs 1Password vs Proton Pass comparison covers passkey support in each.
Step 1: Set up a passkey for your Google Account
Google lets you create passkeys directly from your account settings on any supported device.
- Sign in and open myaccount.google.com/signinoptions/passkeys. You can also get there via Google Account, then Security, then "How you sign in to Google," then Passkeys.
- Choose Create a passkey.
- Confirm with your fingerprint, face or screen lock. On an iPhone or Mac, the passkey is saved to iCloud Keychain; on Android it goes to Google Password Manager; in desktop Chrome, you can choose Google Password Manager, Windows Hello, a phone via QR code, or a hardware security key.
- Back on the Security page, check the Skip password when possible toggle. With it on, Google asks for your passkey first and only falls back to a password when it has to.
Google's help page adds a warning worth taking seriously: create passkeys only on devices you own and use regularly, because anyone who can unlock the device can use the passkey. Passkeys in Google Password Manager sync between your Android devices; ones in iCloud Keychain sync between your Apple devices. If you use both, create one on each side.
Step 2: Set up a passkey for your Apple Account and iCloud Keychain
Apple takes a different approach: it creates a passkey for your Apple Account automatically once you are on iOS 17 or macOS Sonoma or later with two-factor authentication on. When you sign in to an Apple website such as iCloud.com, enter your Apple Account email, choose Sign in with Passkey, and approve the prompt on your iPhone, iPad or Mac.
For every other site and app on your iPhone, look for an "add a passkey" option in the account's security settings, confirm with Face ID or Touch ID, and the passkey lands in iCloud Keychain, visible in the Passwords app and synced to your other Apple devices.
One important limitation: the passkey Apple generates for your Apple Account itself is stored in the Secure Enclave and, as Six Colors reports, cannot be exported to another manager. That is fine for most people, but it means your Apple Account sign-in will always depend on an Apple device.
Step 3: Set up a passkey for your Microsoft account with Authenticator
Microsoft personal accounts (Outlook.com, Xbox, Microsoft 365 Personal) support passkeys through the Advanced Security Options page.
- Go to account.live.com/proofs/manage and sign in.
- Select Add a new way to sign in or verify.
- Choose Face, Fingerprint, PIN, or Security Key.
- Pick where to store it. Microsoft's passkey guide lists four options: Microsoft Password Manager or another synced manager such as Google Password Manager or iCloud Keychain; a phone or tablet via QR code; a physical security key; or Windows Hello, which keeps the passkey local to that PC.
- Follow the device prompt and select Continue or Create.
A note on Microsoft Authenticator. In August 2025 Microsoft removed password storage and autofill from the app, but passkeys were not affected. If a work or school account's passkey lives in Authenticator, keep it enabled as a passkey provider in your phone's settings; disabling it disables those passkeys.
Step 4: Use passkeys on a new or borrowed device with a QR code
All three providers support cross-device sign-in, where the computer shows a QR code and your phone does the signing.
- On the computer, enter your username, then choose the passkey option. On Google's page that is Try another way, then Use your passkey; Microsoft and Apple show a similar "use a phone or tablet" choice.
- Scan the QR code with your phone's camera and tap the Use passkey banner.
- Unlock with your fingerprint, face or PIN.
Both devices need Bluetooth on and must be physically close; that proximity check is part of what makes the process phishing-resistant. The passkey stays on your phone, and nothing is saved to the borrowed machine.
Step 5: Move passkeys between managers, and what iOS 26 export can and can't do
Until recently, passkeys were stuck wherever you created them. That is changing thanks to the FIDO Alliance's Credential Exchange format, which Apple adopted in iOS 26 and macOS 26. As 9to5Mac explains, the transfer is end-to-end encrypted and app-to-app, so no unencrypted CSV file ever lands on disk.
To use it on an iPhone running iOS 26 or later: open Passwords, choose the export option from the menu, select passwords, passkeys or both, then pick the destination app and confirm. On a Mac you will be asked for Touch ID or your account password first. Bitwarden and Dashlane were among the first to accept these imports in September 2025; 1Password had not announced a timeline at that point.
The catches, as of mid-2026:
- The import side is what matters, and support is uneven. Apple's export only works into apps that have implemented the standard on that same device.
- Google Password Manager on Android did not offer passkey import or export at the time of writing, so Android-to-elsewhere transfers may not work for you yet.
- Apple Account passkeys cannot be exported at all.
If your passkeys are stuck, the workaround is simple: create a new passkey in the destination manager, then delete the old one from the account's security settings.
Step 6: Keep a fallback: recovery codes and a second passkey
The NCSC points out that a synced credential manager backs up your passkeys, so a lost phone should not lock you out. That assumes you can still get into the manager, so build in redundancy:
- Register a second passkey with a different provider or on a different device family (for example, one in iCloud Keychain and one on a hardware security key).
- Keep your recovery codes. Google, Apple and Microsoft all offer backup codes or a recovery key; store them in your password manager or somewhere offline.
- Do not delete your password yet unless the service offers a full passwordless mode you have tested from a second device.
Setting up passkeys for Google, Apple and Microsoft takes about ten minutes and removes the most common way accounts get hijacked. Pick a credential manager, create a passkey on each device family you use, turn on "skip password when possible" where offered, and keep recovery codes somewhere safe. With the NCSC now treating passkeys as the default, this is the right moment to switch.
Common problems and fixes
The passkey option does not appear. Check that a screen lock is set, that the OS and browser meet the versions listed above, and, on Apple devices, that iCloud Keychain is on. Some browsers in private mode block passkey creation.
Google says the passkey cannot be used yet. Google notes that a newly created passkey may take up to seven days before it works for sign-in in some situations. Keep your password handy in the meantime.
The QR code sign-in fails. Turn Bluetooth on for both devices, move them closer together, and make sure the phone's camera app scanned the code rather than a third-party QR reader.
Sources and further reading
- NCSC: Leave passwords in the past - passkeys are the future (NCSC)ncsc.gov.uk
- Passkeys: what you need to know (NCSC)ncsc.gov.uk
- FIDO Alliance reports accelerating global passkey adoption on World Passkey Day 2026 (FIDO Alliance)fidoalliance.org
- Sign in with a passkey instead of a password (Google Account Help)support.google.com
- Create a passkey for your Google Account (Google Account Help)support.google.com
- Use passkeys to sign in to websites and apps on iPhone (Apple Support)support.apple.com
- Create and save a passkey (Microsoft Support)support.microsoft.com
- Changes to Microsoft Authenticator autofill (Microsoft Support)support.microsoft.com
- Export keys securely from Passwords to third-party managers (Six Colors)sixcolors.com
- iOS 26: Apple solved one of the biggest passkey headaches (9to5Mac)9to5mac.com