Google, Apple and Amazon keep asking you to “create a passkey.” Here’s what that actually is, why it beats a password, and why a scammer can’t trick you out of one.
Perfect for sending to someone who won't read a whole article.
You log in to Google, or Amazon, or your bank, and up pops a friendly box: “Create a passkey?” Most people hit “Not now,” because what on earth is a passkey, and is this one more thing to forget?
Good news. A passkey is the one security upgrade that is actually easier than what you do today.
A passkey replaces your password with a key that lives inside your phone or computer. You unlock it with your face, your fingerprint or your phone’s PIN. There is nothing to type, nothing to remember, and nothing a scammer can talk you out of.
A password works like a secret knock. You know it, the website knows it, and anyone who overhears it can knock too. That’s the problem. Websites get hacked and lose their lists of passwords. Fake websites trick you into typing yours. People reuse the same one everywhere.
A passkey works like a deadbolt key that never leaves your pocket. The website only keeps the lock. Your phone keeps the key. When you sign in, the website asks your phone to prove it has the key, your phone checks that it’s really you (face, fingerprint or PIN), and the door opens. The key itself is never sent anywhere.
So if that website gets hacked, the thieves get a pile of locks. Locks are useless without keys.
Most account break-ins start with phishing: a fake login page that looks exactly like the real one. You type your password, and they have it.
A passkey can’t fall for that. It’s tied to the real website’s address, so on a fake site your phone simply won’t offer it. There is no secret string for you to type into the wrong box, and no code to read out to a “helpful” caller. You can’t hand over what you can’t see.
This is the first question everybody asks, and it’s a good one. On iPhones, passkeys are backed up in your iCloud Keychain. On Android and Chrome, they’re saved in your Google Password Manager. Sign in to your new phone with the same Apple or Google account and your passkeys come along for the ride.
Many password managers can store passkeys too, which helps if you switch between an iPhone and a Windows computer.
Passkeys are the next step past two-factor authentication. Instead of a password plus a code, the key and the “it’s really you” check happen in one tap.
One short email: the scam making the rounds, one tech word made simple, and one tip to keep you and your family safe. Free, no spam, unsubscribe anytime. Plus a free printable "How to Spot a Scam" sheet for your fridge.
We send one email to confirm it's really you. Your address stays with us and our email service, nobody else. Privacy
The cloud isn't in the sky. It's in giant, humming, refrigerated warehouses full of computers, and they're hungry for electricity and water. Here's what a data center is.
New phones are ditching the little SIM card tray. An eSIM is the same thing, built in and programmed over the air, like a hotel updating your key card without a trip to the front desk.
Click every traffic light. Now do it again. CAPTCHAs are bouncers that keep robots out, and if you keep failing them, the problem is probably your connection, not you.
