How to Set Up Passkeys on iPhone, Android, and Windows: A Beginner's Guide
A password is a secret you type. A passkey is a secret your device keeps, and that single difference explains why Apple, Google, and Microsoft have spent years pushing them into their operating systems, and why your bank, your email provider, and a growing list of shopping sites now offer them. Creating one takes about thirty seconds. The confusing part is knowing where the key lives, how it travels to a new phone, and what happens if you lose the device you set it up on.
When you create a passkey, your device generates a pair of mathematically linked keys. The private half never leaves your phone or PC. It sits in a secure chip and is released by Face ID, a fingerprint, or your device PIN. The public half goes to the website. To sign in, the site sends a challenge, your device signs it, and the site checks the signature. Nothing secret crosses the network, so there is no password to steal, guess, or phish.
Because a passkey is tied to a website's address, a convincing fake login page cannot use it. That is the practical payoff: phishing largely stops working against your account. The trade-off is that losing the device matters more, which is why passkeys sync through your cloud account — iCloud Keychain on Apple, Google Password Manager on Android, your Microsoft account on Windows — and why recovery planning deserves real attention.
Open the website or app where you want the passkey: your Apple Account, Google, Amazon, or any site showing a "Create a passkey" option, usually under Security or Sign-in settings. Tap it, and iOS asks you to confirm with Face ID or Touch ID. The passkey is saved to iCloud Keychain, and the site usually offers to keep your password as a backup. Accept that offer for now. Deleting the password immediately is how people lock themselves out of accounts they still need on older devices.
To review what you have, open the Passwords app (iOS 18 and later) or go to Settings > Passwords. Each entry shows the account, the username, and a note that a passkey exists. Two Apple details are worth knowing. Passkeys sync to every device signed in to the same Apple Account with iCloud Keychain enabled, so a new iPhone gets them automatically. And iOS lets you share a group of passwords and passkeys with family members, which is handy for a streaming account and a poor idea for your bank.
The process is nearly identical, with Google Password Manager doing the work in the background. Open the site in Chrome or in its app, find the passkey option, and confirm with your fingerprint, face, or screen lock. Android saves the passkey to your Google Account, so it appears on any phone or tablet where you are signed in.
Check your inventory at passwords.google.com or in Settings > Google > Manage your Google Account > Security > Passkeys. If you use more than one Google Account, pay attention: passkeys are tied to a specific account, and signing in as the wrong one makes them look missing.
One caveat. Not every Android setup uses Google's system. Third-party managers such as 1Password, Dashlane, and Bitwarden can store passkeys instead, and Chrome will let you choose. Pick one home for your passkeys and stay with it. Splitting credentials across two managers is the fastest way to be unable to find the one you need.
Windows is the most fragmented of the three, because more than one place can hold the key. In Edge or Chrome, when a site offers a passkey, Windows shows a dialog asking where to save it. The usual choice is Windows Hello, which uses your PIN, fingerprint reader, or the face camera on a compatible laptop. Those passkeys are tied to that PC; they do not follow you to your phone.
For a Microsoft account specifically, go to account.microsoft.com > Security > Advanced security options > Add a new way to sign in or verify, then choose passkey. That one does travel with your Microsoft account across devices.
If you use an iPhone alongside a Windows PC, install the iCloud Passwords extension for Chrome or Edge. It lets the browser reach passkeys stored in iCloud Keychain, keeping your Windows sign-ins in the same place as your phone's. A few minutes of setup now saves a lot of confusion later.
Choose "Sign in with a passkey," then pick the option to use a phone or tablet. The screen shows a QR code. Scan it with your phone's camera and approve with Face ID or a fingerprint. The private key never leaves the phone; the two devices talk over Bluetooth and the internet.
If your primary email or a financial account is involved, start the provider's formal recovery process early rather than trying to fix it quietly. Keep a printed recovery code for your main email somewhere physically safe. That sounds old-fashioned, and that is exactly the point.
Passkeys reward a little housekeeping. Once a month, glance at your password manager, confirm the passkeys you rely on are still listed, and check that your main email account has a second way in besides the passkey — a recovery address, a phone number, or both. When you replace a phone, set up the new one and complete a passkey sign-in before you wipe the old device. Never rely on a single passkey for your most important account; a second device or a hardware security key costs little and removes the worst-case scenario. And if a site still does not offer passkeys, keep that password unique and turn on two-factor authentication. That is a solid upgrade, just not the end of the road.
Photo: Pexels / Pixabay
