Passwords are a pain. You’re told to make them long, random and different for every site — then to remember all of them, never write them down, and change them the moment there’s a breach. Nobody actually does this, which is exactly why so many accounts get broken into.
Passkeys are Apple, Google and Microsoft’s answer to the mess. If you’ve unlocked something with Face ID or Touch ID lately, you’ve already used the technology. Here’s what they are, why they’re genuinely safer, and how to start using them on your Apple gear.
What is a passkey?
🔑 In one sentence
A passkey replaces your password with your face or fingerprint — there’s nothing to type, and nothing that can be stolen or guessed.
Behind the scenes, when you create a passkey your device makes a matched pair of digital keys. A private key stays locked on your device and never leaves it. A public key is handed to the website. When you sign in, the site sends a puzzle that only your private key can solve — and it only does so after you approve it with Face ID, Touch ID or your device passcode.
You never see any of this. From your side, signing in is just a glance at your iPhone or a touch of the sensor. No password to remember, no code to copy from a text message.
Why they’re genuinely safer
This isn’t just convenience with a nice coat of paint. Passkeys close off the ways passwords actually get stolen:
- They can’t be phished. A passkey is tied to the real website’s address. If a scam email sends you to a convincing fake of your bank, your passkey simply won’t work there — it knows it’s not the genuine site. This is the big one.
- They can’t leak in a data breach. The website only ever stores your public key, which is useless on its own. There’s no password sitting in a database for hackers to steal.
- They can’t be reused or guessed. Every passkey is unique and random. There’s no “password123” to crack, and nothing you’ve reused across ten other sites.
In short, the most common ways people lose control of their accounts — a phished login, a leaked password, the same password used everywhere — just don’t apply.
How they work on your Apple devices
Apple has built passkeys right into iPhone, iPad and Mac through the Passwords app and iCloud Keychain. If you use Face ID or Touch ID and have iCloud Keychain switched on, you’re ready to go.
The nicest part is that they follow you around. Create a passkey on your Mac and it’s instantly available on your iPhone and iPad, as long as they’re signed in to the same Apple Account. It all syncs through iCloud Keychain, which is end-to-end encrypted — meaning not even Apple can see your keys.
“But what if I lose my iPhone?”
The question we get most, and a fair one. Because your passkeys sync through iCloud Keychain, they’re not trapped on a single device. Lose your iPhone and your passkeys are still on your iPad and Mac, and they’ll be waiting on your replacement phone the moment you sign back in to your Apple Account.
If you somehow lost every Apple device at once, Apple has an iCloud Keychain recovery process to get them back. The catch worth knowing: it all hinges on your Apple Account. Keeping that account secure — with a strong password you do still remember, and two-factor authentication — matters more than ever.
Using them beyond the Apple world
Need to sign in on a friend’s Windows PC or a public computer? You don’t copy your passkey across. Instead the site shows a QR code, you scan it with your iPhone, approve with Face ID, and you’re in — the passkey never leaves your phone. It’s a tidy, secure way to log in anywhere without exposing anything.
One honest limitation: Apple and Android don’t sync passkeys directly between each other. If you live across both, a third-party password manager like 1Password or Bitwarden can bridge the gap.
Where can you use them today?
More places every month. Apple, Google, Microsoft, Amazon, eBay, PayPal and GitHub already support passkeys, and banks and government services are steadily coming on board. You don’t have to switch everything at once — the sensible approach is to add a passkey to your most important accounts first (your Apple Account, email and banking) and let the rest follow as sites offer it.
It’s still early days, so you’ll keep a few passwords around for a while yet. But the direction is clear: the big players are all committed, and passwords are on the way out.
Want a hand getting started?
If passkeys sound good but you’d rather not fumble through it alone, that’s what we’re here for. Pop in to see us in Coorparoo and we’ll walk you through setting one up on your iPhone, iPad or Mac, make sure iCloud Keychain and your Apple Account are properly secured, and answer the “what if” questions in plain English. As an Apple Authorised Service Provider, this is exactly the sort of thing we help people with every day.
Get in touch or drop past the shop — no question is too basic, and we’d rather you felt confident than caught out.