Passkeys explained: what they are, how they work, and how to set one up

Passwords have had a good run. They are also the single biggest reason businesses get hacked, and everyone knows it. That is why Microsoft, Apple, Google and just about every major bank are pushing hard towards passkeys.

If you have heard the word and nodded along without really knowing what it means, this one is for you. No jargon, no lectures about password managers.

What is a passkey?

A passkey is a login credential that lives on your phone, laptop or a small USB security key, and unlocks with your fingerprint, your face, or the PIN you already use on that device.

That is the whole idea. Instead of remembering a password and typing it in, you prove it is you by unlocking your own device. The website or app gets confirmation that the right person, on the right device, wants to log in.

What that looks like in practice:

  1. You go to log in to Microsoft 365.
  2. Instead of asking for a password, it asks you to confirm on your phone or laptop.
  3. You touch the fingerprint sensor, or look at the camera, or type your device PIN.
  4. You are in.

No password typed. No code to wait for. No app to open and copy digits out of. Usually two or three seconds, start to finish.

How they actually work

You do not need to understand this bit to use passkeys, but it explains why they are so much harder to steal. Bear with us for four paragraphs.

When you set up a passkey, your device quietly creates two matching pieces of maths. Think of them as a lock and a key.

The lock (the public key) gets sent to the website and stored there. It is not secret. Anyone can have it and it is useless on its own.

The key (the private key) never leaves your device. Ever. It is stored in a protected chip on your phone or laptop and only becomes usable when you unlock it with your fingerprint, face or PIN.

When you go to log in, the website sends your device a random puzzle. Your device unlocks the private key, solves the puzzle, and sends back the answer. The website checks the answer against the lock it has on file. If it matches, you are in. The private key itself never gets transmitted, and no secret changes hands.

Three consequences of that design, and they are the reason this whole thing is worth the bother:

Nothing to steal in a data breach. If the website gets hacked, all the attackers get is a pile of public keys. Useless. Compare that to the password you probably reused on four other sites.

Nothing to phish. A fake login page cannot trick you into handing over a passkey, because there is nothing to hand over. Better still, a passkey is welded to the exact website it was made for. If you land on a lookalike domain, your device simply will not offer the passkey. It does not get fooled by a convincing logo the way people do.

Your fingerprint stays yours. Your biometrics never leave your device and are never sent to the website or to Microsoft. The device just tells the website "yes, this is the right person". Nobody is storing your thumbprint on a server somewhere.

Passwords, SMS codes and passkeys, side by side

| | Password | Password plus SMS code | Passkey |<br>| --- | --- | --- | --- |<br>| Can be guessed or cracked | Yes | Yes, then blocked by the code | No |<br>| Can be phished | Yes | Yes | No |<br>| Works if someone steals your SIM | Not relevant | Yes, that is the problem | No |<br>| Anything to remember | Yes | Yes | No |<br>| Time to log in | 10 to 30 seconds | 30 to 60 seconds | 2 to 5 seconds |

That last row is the one that wins people over. Passkeys are not just safer, they are genuinely quicker. It is rare that the secure option is also the convenient one.

The two kinds of passkey

Worth knowing the difference, because it affects what happens when you get a new phone.

Synced passkeys are saved into your device's built in credential manager, which means iCloud Keychain on Apple gear, Google Password Manager on Android, or a password manager like 1Password or Bitwarden. They then sync across all your devices signed in to that account. Set one up on your iPhone and it is on your iPad and Mac too. Lose the phone, buy a new one, sign in, and your passkeys come back. This is the easy option for most people.

One caution the Australian Signals Directorate makes and it is worth repeating: only sync your passkeys to devices you actually own and trust. Every device you sync to is another place someone could try to get at them, so the family iPad that the kids use is not the place for your work credentials.

Device bound passkeys stay on one specific device and never leave it. That covers a passkey stored in the Microsoft Authenticator app, a passkey created on a Windows PC with Windows Hello, or a physical security key such as a YubiKey. Slightly more locked down, and often what a business will use for administrator accounts or for anyone with access to money or sensitive records. The trade off is that if the device is lost, that particular passkey goes with it, so you need a backup method registered.

For most staff, synced passkeys are the right call. For the finance team and IT admins, device bound is worth the extra strictness.

How to set one up

For your work Microsoft 365 account

Your IT provider or administrator needs to have passkeys switched on for your organisation first. Assuming that is done:

  1. On your work computer, go to your Microsoft security info page (your IT team will send you the link, or search "My Sign-Ins" from your Microsoft 365 portal).
  2. Choose to add a sign in method.
  3. Pick the passkey option. Depending on how your organisation is set up, you will be offered a passkey in the Microsoft Authenticator app, a passkey on this device, or a security key.
  4. Follow the prompts. It will ask you to unlock with your fingerprint, face or PIN to confirm.
  5. Done. Next time you log in, choose the passkey option rather than typing your password.

The whole thing takes about a minute. Do it while you are sitting at your desk with a decent connection, not on the run.

For your personal accounts

Most of the big ones now support passkeys, including Google, Apple, Microsoft, Amazon, PayPal and a growing number of Australian banks. Look under the security or sign in settings for anything mentioning passkeys, and follow the prompts. Same process, same one minute.

The official step by step guides are worth bookmarking:

A tip worth following

Set up more than one. A passkey on your phone plus one on your work laptop means a flat battery or a forgotten phone does not lock you out of your own day. If you only ever register one method, you have built yourself a single point of failure.

Common questions

What if I lose my phone?<br>If you used a synced passkey, sign in to your Apple or Google account on the new phone and the passkeys come back with everything else. If it was device bound, that passkey is gone and you use your backup method, then register a new one. Either way, whoever finds your phone cannot use your passkey. They would need your fingerprint, your face or your PIN.

Do I still need my password?<br>For now, usually yes. Most organisations keep the password in place as a fallback while they transition. Over time the aim is to remove it entirely, and that is when the real security benefit lands.

What about shared computers, like a reception desk or a workshop PC?<br>Passkeys are tied to a person, not a shared login, so this needs a bit of planning. Usually the answer is a passkey on each person's phone that they use to sign in to the shared machine, or physical security keys. Worth sorting out properly rather than leaving one generic account that everyone knows the password to. Which, let us be honest, is what a lot of businesses are doing right now.

Is this just Microsoft doing its own thing?<br>No. Passkeys are built on an open industry standard from the FIDO Alliance, developed jointly by Apple, Google, Microsoft and others. A passkey is not locked to one company's ecosystem, and the word passkey means the same thing whichever device you are on.

Is a fingerprint really more secure than a strong password?<br>Yes, but not for the reason people assume. The fingerprint is not the security, it is just the way you unlock the private key sitting on your device. The security comes from the fact that the credential cannot be phished, guessed, reused or stolen from a server. Even a genuinely excellent password fails all four of those tests.

Can I be forced to unlock it?<br>If someone has physical control of you and your device, that is a different category of problem and no login method solves it. For the everyday risks that actually hit businesses, which is phishing emails, credential stuffing and leaked password lists, passkeys are a very large step forward.

Why this matters right now

Microsoft is making passkeys the default sign in method for Microsoft 365 from 1 September 2026, and switching off text message and voice call verification entirely on 1 February 2027. If your business still relies on codes by text, you have a deadline. We have covered that change and what it means in a separate post.

Where to read more

The upside is that this is one of the rare security upgrades your staff will actually thank you for, once they have used it for a week and realised they are not waiting for texts anymore.

If you want a hand rolling passkeys out across your team, or you are not sure where your business currently stands, give the GBS team a call. We will check how your Microsoft 365 is set up, tell you what needs changing, and handle the rollout without turning it into a production.

Simple tech. Smart thinking. Regional roots.