What is a passkey, and how does it work?
A passkey is a sign-in credential that replaces your password with something on your device, usually your fingerprint, face or a PIN, standing in for a cryptographic key rather than a word you type or a code sent to your phone. Unlike a password, a passkey cannot be guessed, reused from another site's data breach, or typed into a fake login page, because it never leaves the device it was created on.
How a passkey actually works
When you set one up, your device creates two mathematically linked keys: a private key that stays on the device, and a public key that gets handed to the website or service, such as Microsoft 365. Signing in later works like a lock and key: the service sends a challenge only your private key can answer correctly, your device answers it after you unlock the device with your fingerprint, face or PIN, and the service checks the answer against the public key it already holds. Your fingerprint or PIN never travels anywhere. It only unlocks your own device locally, the same way it already unlocks your phone's home screen.
Why a passkey cannot be phished
A password is a shared secret: if you type it into a convincing fake login page, the attacker now has it too. A passkey is different because it is bound to the exact website it was created for. If a scam site pretends to be Microsoft's login page, your device checks the address, sees it does not match, and simply will not produce an answer for it, the same way a key cut for one specific lock will not turn in a different lock no matter how similar the two doors look. This is the property that makes passkeys resistant to the fake-login-page scams (technically called adversary-in-the-middle phishing) that catch out passwords, text-message codes and approve-this-prompt notifications alike.
What using a passkey looks like day to day
In Microsoft 365, a passkey usually lives in the Microsoft Authenticator app on your phone or in Windows Hello on your PC. Signing in looks like: enter your email address, get a prompt to use your fingerprint, face or PIN, confirm, and you are in. There is no password field to fill in and no six-digit code to copy across from a text message or an app. Passkeys created on Windows, Android or iOS all follow the same underlying FIDO2 standard, which is why Microsoft, Apple and Google devices can each create and use them.
Passkey vs password vs approve-the-prompt MFA, in one paragraph
A password is a secret you type, which means it can be phished, guessed or reused. A one-time code or an approve-this-prompt notification (like standard Microsoft Authenticator push) is stronger, but it can still be relayed through a fake login page because the user is the one approving it, not the device checking the address. A passkey removes the human from that step: the device itself checks the address before it will answer, which is why it satisfies phishing-resistant MFA requirements that push notifications do not. See whether passkeys meet the Essential Eight Maturity Level 2 requirement for what that means for compliance.
Where to go next
Is Microsoft retiring SMS and voice MFA, and what are the deadlines?
Do passkeys meet the Essential Eight Maturity Level 2 MFA requirement?
Passkeys vs security keys: which does your business actually need?
How Blue Arc IT Solutions helps
We roll out passkeys for Microsoft 365 businesses end to end, from tenant configuration through to the short, plain-English explainer your staff actually read. We have supported Australian businesses since 2004 and deliver nationally from Canberra. Start at the passkeys for Microsoft 365 businesses hub, or get in touch.
Last reviewed: 23 July 2026. Passkey support across Windows, Android and iOS is still expanding; the mechanism described here is the FIDO2/WebAuthn standard shared by Microsoft, Apple and Google, documented by the FIDO Alliance.
Frequently asked questions
Do I need to remember a passkey like a password?
No. There is nothing to remember or type. Your device stores the passkey and produces it automatically once you unlock the device with your fingerprint, face or PIN, the same way you already unlock your phone.
Is a passkey the same thing as my fingerprint or Face ID?
No. Your fingerprint or face only unlocks the device you are using. It is never sent anywhere and is not the credential itself. The actual passkey is a cryptographic key pair stored on the device, and the biometric or PIN simply proves it is really you before that device uses it.
What happens if I lose my phone or computer?
A device-bound passkey is lost with the device, so you register a new one on your replacement using your account's recovery process. Some passkeys sync across a person's own devices through their phone or computer maker's account, which makes recovery easier but is not accepted by every organisation's security policy.