Passkeys are the most significant change to online authentication in a decade. They are being rolled out by Google, Apple, Microsoft, and hundreds of major services — but many people are confused about how they relate to two-factor authentication. Are passkeys a replacement for 2FA, or something different entirely? This guide explains everything.
What Is 2FA?
Two-factor authentication adds a second verification step after your password. The most common forms are TOTP codes from an authenticator app (the 6-digit codes that change every 30 seconds), SMS codes sent to your phone, and hardware security keys. The idea is that even if an attacker steals your password, they still cannot access your account without the second factor.
Standard 2FA has a significant weakness: TOTP codes and SMS codes can be intercepted. A sophisticated attacker can create a fake login page that relays your credentials and your 2FA code to the real service in real time — before the 30-second window expires. This is called a real-time phishing attack, and it completely bypasses TOTP-based 2FA.
What Are Passkeys?
A passkey is a cryptographic credential that replaces both your password and your 2FA step in a single action. When you create a passkey for a service, your device generates a pair of cryptographic keys: a private key that stays locked on your device, and a public key that is registered with the service. When you sign in, your device signs a challenge from the server using the private key. The server verifies the signature using the stored public key — no password, no code, nothing to type.
To use the passkey, you authenticate locally on your device — with Face ID, a fingerprint, Windows Hello, or your device PIN. This local authentication unlocks the private key, which then proves your identity to the server.
Passkeys vs 2FA: Key Differences
Phishing resistance: Passkeys are cryptographically phishing-resistant. TOTP codes are not — a real-time phishing proxy can steal them. Hardware security keys (FIDO2) share this phishing resistance, but they are a separate device you need to carry.
User experience: Passkeys require a single step — tap your fingerprint or face, done. Traditional 2FA requires entering a password, then opening your authenticator app, then typing or copying a 6-digit code. Passkeys are both more secure and faster.
No shared secret: With TOTP, both your app and the server share a secret key. If the server is breached and that secret is stolen, an attacker can generate valid codes forever. Passkeys have no shared secret — only the public key is stored on the server, which is mathematically useless to an attacker on its own.
Account recovery: Losing access to your passkey device is handled differently than losing an authenticator app. Passkeys sync across your devices through Apple iCloud Keychain, Google Password Manager, or a password manager like 1Password. Recovery is generally simpler than recovering from a lost authenticator.
Do Passkeys Replace 2FA?
Yes — when you sign in with a passkey, you are already satisfying two authentication factors simultaneously. The device itself is the "something you have" factor, and your biometric or PIN is the "something you are or know" factor. Services that adopt passkeys no longer require a separate 2FA step.
However, passkeys are not yet available everywhere. As of 2026, many services still rely on passwords plus 2FA. For those services, using an authenticator app remains the right approach — it is still far better than a password alone.
Should You Switch to Passkeys?
Yes, wherever available. Passkeys are more secure than passwords plus TOTP, easier to use, and immune to phishing. The services most important to protect — Google, Apple, Microsoft, GitHub — all support passkeys now. Enable passkeys on these accounts as a priority.
Keep your authenticator app for services that have not yet adopted passkeys. The transition will take a few more years to complete across the entire web, but the direction is clear: passkeys are the future of authentication, and 2FA as a separate step is gradually being phased out.
How to Set Up a Passkey
The process varies by service but is generally the same: go to your account's security settings, look for "Passkeys" or "Sign-in options", and click "Create a passkey" or "Add a passkey". Your browser or device will prompt you to authenticate with your biometric or PIN, and the passkey is created. Next time you sign in, you simply authenticate locally instead of entering a password.
Passkeys created on your phone sync to other devices through your platform's credential manager (iCloud Keychain for Apple devices, Google Password Manager for Android/Chrome, or a third-party manager like 1Password or Bitwarden). You do not need to create a separate passkey on each device.
What Happens When You Create a Passkey (Under the Hood)
When you create a passkey, your device runs a WebAuthn ceremony that produces a key pair bound to the site's origin. The private key never leaves the device's secure enclave — on iPhones it lives in the Secure Enclave, on Android in a trusted execution environment, and on Windows in the TPM chip. Even the operating system cannot extract the private key, which is why a passkey cannot be copied off your phone and used somewhere else.
At sign-in, the server sends a challenge — a random string — and the secure enclave signs it with the private key. The signature proves possession of the key without ever transmitting it, and because the challenge is bound to the domain and the current session, the signature cannot be replayed on another site or reused later by an attacker who recorded it.
This is the comparison that matters: a stolen password is a static secret that works anywhere, and a stolen TOTP code works for thirty seconds on any service that accepts it. A passkey signature works for exactly one request on exactly one domain, which makes it the closest thing to an unforgeable credential that consumer authentication offers today.
Synced vs Device-Bound Passkeys: Know the Difference
Not all passkeys behave the same way. Synced passkeys — the default on iPhone, Android, and inside password managers — back up the private key to the cloud with end-to-end encryption, so your passkeys follow you onto a new phone. Device-bound passkeys stay on one piece of hardware, usually a security key, and are preferred by enterprises and high-security users who want to control exactly which hardware can authenticate.
The trade-off is straightforward. Synced passkeys are easy to recover but live on the same platform account you are using the passkey to protect. Apple and Google mitigate this with recovery keys and backup codes, but you should still treat the Apple ID or Google Account holding your passkeys as a crown jewel — an attacker who takes it over can, in the worst case, sync your passkeys onto a device they control.
For most people, the convenience of synced passkeys wins. If you handle sensitive data, consider keeping a device-bound passkey on a hardware key for your email and password manager, and reserve synced passkeys for everyday services where rapid recovery matters more than hardware control.
Common Passkey Setup Mistakes to Avoid
Creating a passkey on a device you are about to replace is the most common error. If you register a passkey only on an old phone and then wipe it, you may be left with a service that wants a recovery code you never saved. Create passkeys on hardware you plan to keep, or verify that they synced to your new device before you let go of the old one.
A second mistake is skipping redundancy. Most services let you register more than one passkey — add one on your phone and one on a laptop or security key. Two passkeys from different ecosystems (say, one in iCloud Keychain and one in Bitwarden) mean a single platform outage or account problem will not lock you out of everything.
Finally, do not delete your authenticator app the moment a service shows a passkey option. Keep your TOTP codes active until you have signed in with your passkey successfully on every device you use, because many recovery flows still fall back to the authenticator when a passkey is lost.
Passkey Recovery: If You Lose Every Device
Passkeys shift the recovery problem from "I lost my 2FA codes" to "I lost my passkey devices." Services handle this differently: Google prompts you to save backup codes or a recovery key when you create a passkey, while Apple ties passkeys to your Apple ID, whose account recovery process can take several days. Your password manager is usually the fastest path — if the passkeys live there, signing into the manager on a new device restores everything.
Before you rely on a passkey-only setup, check which recovery options the service actually offers. Some services still keep a password as a fallback, which means you have two secrets to lose rather than one. The safest arrangement is a passkey plus a stored backup code or recovery key, kept in a separate place from your phone.
If you are locked out, the official recovery path beats every workaround. Start the service's account recovery process immediately rather than trying unofficial tools — they have no power to restore access and are often phishing traps that harvest exactly the credentials a passkey would otherwise protect.