Passkeys Guide: How to Turn Them On for Google, iPhone and WhatsApp
A message that looks like it's from Google says: "Suspicious activity on your account, sign in to confirm." You tap the link, the page looks exactly right, and you type your password and the SMS code you just received. Minutes later someone else owns your account. A password and a one-time code are both things you can type, and anything you can type can be stolen. Passkeys were designed to close exactly that door.
In short: A passkey is a passwordless way to sign in. It relies on a cryptographic key stored on your phone or computer, which you open with your fingerprint, face or screen-lock PIN. There is nothing to type, and the key only works with the real site it was created for, so fake phishing pages can't use it.
What are passkeys?
Passkeys are an open standard from the FIDO Alliance, supported by Google, Apple and Microsoft. When you create one, your device generates a pair of keys: a public key that goes to the website, and a private key that stays with you and never leaves your device or your encrypted password manager. When you sign in, the site sends a "challenge," and your device signs it with the private key after you confirm it's you with a fingerprint, face scan or PIN.
Your fingerprint itself is never sent anywhere. It's only the way you open the key on your own device, like opening your phone in the morning.
Day to day, instead of remembering a long password and waiting for a late text message, you tap sign in, touch the sensor and you're done. One account can have several passkeys, say one for your phone and one for your laptop, and you can remove any of them at any time.
Why are passkeys safer than passwords?
- Phishing resistance: Google's developer documentation says passkeys are bound to a website or app's identity, which is why they resist phishing. A fake page on a different domain won't get a valid signature, however convincing it looks.
- No secret on the server: the site stores only your public key, so if its database leaks, attackers get no passwords to try on your other accounts.
- No reuse: every account gets its own key, which ends the "same password everywhere" problem.
- Fewer SMS codes: many services drop the text-message code when you use a passkey, reducing the risk of SIM theft or intercepted messages.
If you suspect something has already happened to your account, first check the signs that your Google account has been hacked.
How to set up a passkey on your Google account
Google's help page lists these requirements: Android 9 or iOS 16 or later on phones; Windows 10, macOS Ventura or ChromeOS 109 or later on computers; an up-to-date browser; and a screen lock turned on. On Apple devices, iCloud Keychain must be on.
- Go to myaccount.google.com/signinoptions/passkeys and sign in.
- Tap "Create a passkey," then confirm.
- Confirm with your fingerprint, face or PIN when prompted.
Google then turns on "Skip password when possible" by default. If you'd rather keep your password as the first step, go to "Security & sign-in" and switch it off. A FIDO2 hardware key also works via "Use another device."
One warning straight from Google: anyone who can get into your device can access your Google Account. Don't create a passkey on a device you share with others.
Passkeys on iPhone and iCloud Keychain
There's no single "turn on passkeys" switch; your iPhone uses them whenever a site or app offers one. You need iOS 16 or later, with iCloud Keychain and two-factor authentication on your Apple Account.
- Make sure password syncing with iCloud is on: Settings, then your name, then iCloud.
- When signing up on a site that supports passkeys, or from its security settings after signing in, choose to create a passkey.
- Tap "Continue" and confirm with Face ID or Touch ID.
Passkeys are saved in the Passwords app and sync across your devices. Apple says iCloud Keychain is end-to-end encrypted with keys it doesn't know. If you don't see a passkey option on a site, it simply means that site doesn't support passkeys yet.
How to turn on a passkey in WhatsApp
In August 2026 WhatsApp said more than a billion people had set up passkeys, letting them sign back in with a fingerprint, face or screen lock instead of codes.
- Open WhatsApp and go to Settings.
- Choose "Account," then "Passkeys."
- Tap "Create passkey," then "Continue," and confirm with your screen lock.
If you use both an Android phone and an iPhone, WhatsApp now lets you add more than one passkey to the same account. For more protection, read our WhatsApp security and privacy tips.
Passkeys for a Microsoft account
These steps are for a personal Microsoft account (Outlook, Hotmail, Xbox). Work and school accounts follow their organization's settings.
- On the device where you want the passkey, open Advanced Security Options at account.live.com/proofs/manage.
- Choose "Add a new way to sign in or verify."
- Select "Face, fingerprint, PIN, or security key."
- Follow the prompts and choose "Continue" or "Create," or pick another place to save it.
To remove it later, return to the same page, select the passkey from the list of ways to prove who you are, and choose "Remove."
What happens if you lose your phone?
The answer is reassuring if you prepare ahead:
- Synced passkeys come back: passkeys saved in iCloud Keychain or Google Password Manager appear on your new device after you sign in. Apple says Keychain can be recovered even if you lose all your devices.
- Remove the lost device's passkey: from another device, open your account settings and delete the passkey tied to the missing phone, as Google recommends.
- Keep your backups: keep a recovery phone number and email, and ideally a second passkey on another device.
Note that Apple allows only ten attempts to recover iCloud Keychain; after that it's lost for good, so don't guess codes at random.
FAQ
Is a passkey better than two-step verification?
It combines something you have (your device) with something you are or know (fingerprint or PIN), and it can't be typed into a fake page.
Do companies get my fingerprint?
No. Your fingerprint and face data stay on your device and are only used to open the key locally.
Can I sign in on a computer that doesn't have my passkey?
Yes. The computer shows a QR code that you scan with your phone, Bluetooth checks that the phone is nearby, and you confirm on the phone.
Should I delete my password after creating a passkey?
Not yet. Most services keep the password as a fallback, so make it strong, store it in a password manager, and don't reuse it elsewhere.
The takeaway
Start today with Google, which holds your email and photos, and WhatsApp, which is how family and clients reach you. Five minutes is enough, and after that even a convincing phishing message gets nothing, because there's nothing left for you to type into it.
Sources: Google Account Help, Google's developer documentation on passkeys, Apple Support and the Apple Platform Security guide, the WhatsApp Blog, Microsoft Support, and the FIDO Alliance.
Because account protection starts with how you sign in, we draw on this topic from following Arabic websites and specialized blogs, to what Egypt stores, Kuwait stores, vitamin stores and international sites offer, with Mashhor for social media services as a key to growth.
That's it, friends. We hope you found this useful โ
Best wishes from the #Ezznology team.
Join our community on Telegram and our Facebook group, and follow us on Google News.
You may also like:
Signs Your Google Account Has Been Hacked
How to Protect and Recover a Hacked Facebook Account
