Latest
Home
Posts

Passkeys Explained: Why They're Replacing Passwords

After a 16 billion password leak in 2026, passkeys are now essential. Here's what they are and how to set one up on Google, Apple & Microsoft.
Add
Passkeys Explained: Why They're Replacing Passwords

For years, "use a strong password and don't reuse it" has been the standard security advice — and for just as many years, almost nobody has actually followed it. Passkeys are the first real replacement for passwords that doesn't rely on you remembering anything at all, and in 2026, they went from a nice-to-have feature to something security experts are calling genuinely essential.

📋 Table of Contents
  1. Why This Suddenly Matters: The 16 Billion Password Leak
  2. What Exactly Is a Passkey?
  3. Why Passkeys Are Genuinely Safer, Not Just Different
  4. What You Need Before You Start
  5. How to Set Up a Passkey on Google
  6. How to Set Up a Passkey on Apple
  7. How to Set Up a Passkey on Microsoft
  8. Which Accounts to Switch First
  9. If You Mix Android, iPhone & Windows
  10. The One Real Downside: Recovery
  11. Frequently Asked Questions
Why the urgency: In January 2026, a leak exposing an estimated 16 billion passwords pushed passkeys from "nice to have" to essential almost overnight. Unlike passwords, passkeys can't be phished, can't be leaked in a database breach, and don't require you to remember anything at all.

This guide explains exactly what a passkey is, why it's fundamentally safer than even a strong password, and the real, current steps to set one up on Google, Apple, and Microsoft accounts.

Why This Suddenly Matters: The 16 Billion Password Leak

Passwords fail in a very specific, structural way: they exist as data that has to be stored somewhere, transmitted somewhere, and typed by a human being who can be tricked. Every one of those steps is a point of failure — and in early 2026, that failure played out at a genuinely massive scale.

The numbers behind the shift: A standard consumer-grade GPU in 2026 can crack an 8-character password in roughly 12 minutes. Passkeys use 2048-bit RSA or 256-bit elliptic curve cryptography instead — there is no offline cracking attack against them at all. Organisations that have rolled out passkeys have seen account-takeover attacks drop by more than 90% within the first year, according to the FIDO Alliance.

What Exactly Is a Passkey?

A passkey is a cryptographic credential that replaces your password entirely. Instead of typing a secret word that gets sent to a server — where it can be intercepted, guessed, or stolen — your device creates a unique pair of digital keys.

  1. Your device generates a private key, which never leaves that device, and a public key, which is sent to the website or app you're signing into
  2. When you log in, the service asks your device to prove it holds the matching private key
  3. Your device proves this using your fingerprint, face unlock, or device PIN — nothing is ever typed, and the private key itself is never transmitted anywhere
  4. Passkeys are built on the FIDO2/WebAuthn standard, developed by the FIDO Alliance, whose members include Apple, Google, and Microsoft
In plain terms: A passkey works like a smart lock that only responds to your specific fingerprint — the lock itself has no idea what your fingerprint "looks like" in a way that could be stolen and reused elsewhere. There's nothing to phish, because there's no secret word being typed or transmitted in the first place.

Why Passkeys Are Genuinely Safer, Not Just Different

  • No password to phish — since nothing is typed and sent to a server, there's no secret for a fake login page to steal
  • No password to reuse — every passkey is unique to the specific site it was created for, which silently fixes the most common consumer security mistake: using the same password across a dozen different sites
  • No password database to breach — services only ever store your public key, which is useless to an attacker without the matching private key that lives solely on your device
  • Inherently multi-factor — a passkey combines something you have (your device) with something you are (your fingerprint or face), eliminating the friction of separate two-factor authentication codes

What You Need Before You Start

You don't need to buy new hardware, but you do need a reasonably modern, unlockable device.

  • Android phone: Android 9 or later, Chrome 109 or later
  • iPhone/Mac: A device supporting Face ID, Touch ID, or a device passcode
  • Windows PC: Windows 10 or 11 with Windows Hello configured (PIN, fingerprint, or facial recognition)
  • A passkey "vault": Apple Passwords (formerly iCloud Keychain), Google Password Manager, Microsoft Authenticator, or a third-party manager like 1Password, Bitwarden, or Dashlane

How to Set Up a Passkey on Google

  1. Sign in to your Google Account at myaccount.google.com
  2. Open Security from the left navigation menu
  3. Choose Passkeys and security keys (sometimes labelled "How you sign in")
  4. Click Create a passkey
  5. Confirm using your device's fingerprint, face unlock, or screen lock
  6. Your passkey saves to Google Password Manager, which syncs across your other signed-in devices automatically
Where Google works best: If you're already living inside Android and Chrome, passkeys feel like the default fast path — enter your email, then approve with fingerprint or face unlock, and you're in.
📱 You Might Also Like
More posts you may enjoy on BytSphere:

 

How to Set Up a Passkey on Apple

  1. Visit a website or app that supports passkeys, using Safari (or another supported browser)
  2. When prompted to create an account or sign in, choose Create a Passkey
  3. Authenticate using Face ID, Touch ID, or your device passcode
  4. Your passkey saves automatically to the Apple Passwords app (formerly part of iCloud Keychain)
  5. To review your saved passkeys later: open Apple Passwords → authenticate → tap Passkeys in the sidebar to see the full list, or tap any entry for details
On Mac specifically: Go to Apple menu → System Settings → Privacy & Security, then scroll to find Passwords and Passkeys to review or manage your saved credentials directly from your computer.

How to Set Up a Passkey on Microsoft

  1. Go to mysignins.microsoft.com/security-info, or open your Microsoft account and navigate to Security info
  2. Select Add sign-in method
  3. Scroll to the section labelled Passkeys
  4. Select Create a passkey
  5. Follow the prompts to store the passkey on your device — your phone, laptop, or a security key
  6. Confirm using your device's unlock method (Windows Hello, fingerprint, or face recognition)
Using a work or school Microsoft account? If you don't see Passkey as an available option, your organisation's IT administrator may need to enable it first within Microsoft Entra ID before you can set one up.

Which Accounts to Switch First

You don't need to migrate every single account at once. Prioritise based on what would cause the most damage if compromised.

  1. Your email account — almost every other account's password reset flows through your email, making it the single highest-value target to protect first
  2. Your password manager — if you use one, securing the master account with a passkey protects everything stored inside it
  3. Financial logins — banking apps, payment platforms, and anything tied directly to your money
  4. Work accounts — anything that, if compromised, could cascade into a breach of your employer's systems or data
You can keep your existing password as a backup during the transition on most services — moving to passkey-based sign-in doesn't force you to delete your old login method immediately, giving you a safety net while you get comfortable with the new process.

If You Mix Android, iPhone & Windows

This is genuinely where most people trip up, so it's worth understanding clearly before you start creating passkeys everywhere.

Apple, Google, and Microsoft each sync passkeys to their own ecosystem by default. A passkey created and stored in Apple's Passwords app doesn't automatically appear on an Android phone, and vice versa — native passkeys don't sync between ecosystems on their own. Apple-to-Android sync specifically requires a third-party password manager to bridge the gap.
  • If you live entirely within one ecosystem (all Apple, or all Android/Chrome), the native option — Apple Passwords or Google Password Manager — is simplest and requires no extra setup
  • If you mix an iPhone with a Windows PC, or switch between multiple browsers regularly, a cross-platform manager like 1Password or Bitwarden is the better choice — the cryptography and security level is identical either way; the choice mainly affects convenience and sync, not safety

The One Real Downside: Recovery

Passkeys solve nearly every weakness of traditional passwords, but they introduce one genuine trade-off worth understanding before you commit fully.

If you lose access to every device holding your passkeys, and have no backup, account recovery can be genuinely harder than with a traditional password. Recovery in that scenario falls back to the service's own fallback process — which, for many services, may still rely on email or SMS verification as a last resort.
  • Keep at least one backup device with your passkeys synced, if your ecosystem supports it, rather than relying on a single phone alone
  • Don't delete your recovery email or phone number from an account even after switching to a passkey — these remain your safety net if something goes wrong
  • Consider a dedicated password manager (1Password, Bitwarden) if you want passkey backup and recovery options that don't depend entirely on a single device manufacturer's ecosystem
The bottom line: Passkeys are widely regarded as the single biggest improvement in consumer authentication security since two-factor authentication first arrived. They are not experimental — they're production-ready and actively endorsed by Apple, Google, and Microsoft alike. Start with your email and financial accounts, keep your password manager active for services that don't yet support passkeys, and you'll have meaningfully reduced your real-world risk of account takeover within a single afternoon of setup.

Have you switched any of your accounts to passkeys yet? Drop a comment below and share your experience with other BytSphere readers.

Stay tuned to BytSphere for more practical cybersecurity how-tos made for Nigerians.

Frequently Asked Questions

Are passkeys actually safer than a strong, unique password?

Yes, meaningfully so. Passkeys use 2048-bit RSA or 256-bit elliptic curve cryptography, and there is no offline cracking attack against them at all — compare that to a standard consumer-grade GPU in 2026 being able to crack an 8-character password in roughly 12 minutes. Passkeys also can't be phished, since there's no secret word ever typed or transmitted to a server, and they can't be leaked in a database breach, since services only ever store your public key. The FIDO Alliance reports that organisations rolling out passkeys see account-takeover attacks drop by more than 90% within the first year.

Do I need to buy new hardware to use passkeys?

No, but you do need a reasonably modern, unlockable device. For Android, you need Android 9 or later with Chrome 109 or later. For Apple devices, you need Face ID, Touch ID, or a device passcode configured. For Windows, you need Windows 10 or 11 with Windows Hello set up (PIN, fingerprint, or facial recognition). If your device already supports biometric unlock or a secure PIN, you can start using passkeys today without purchasing anything additional.

What happens if I lose my phone and it has all my passkeys on it?

This is the one genuine downside of passkeys compared to traditional passwords. If you lose access to every device holding your passkeys and have no backup, recovery falls back to the service's own fallback process, which may still rely on email or SMS verification. To protect against this, keep at least one backup device synced with your passkeys where your ecosystem supports it, don't remove your recovery email or phone number from accounts even after switching to a passkey, and consider a cross-platform password manager like 1Password or Bitwarden for more flexible backup options.

Can I use passkeys if I switch between an iPhone and a Windows PC?

Yes, but native ecosystem syncing has real limits worth knowing. Apple, Google, and Microsoft each sync passkeys to their own ecosystem by default, meaning a passkey created in Apple's Passwords app doesn't automatically appear on a Windows PC or Android phone — Apple-to-Android sync specifically requires a third-party password manager to bridge the gap. If you regularly mix device types or browsers, using a cross-platform manager like 1Password or Bitwarden from the start is the better choice, since it syncs consistently across every platform rather than being tied to one manufacturer's ecosystem.

Do I have to delete my password once I set up a passkey?

No, on most services you can keep both during the transition. Setting up a passkey typically adds it as a new, preferred sign-in method rather than immediately deleting your existing password — passkeys are usually tried first, with the password available as a fallback. This gives you a safety net while you get comfortable with the new sign-in process, though the security benefit is strongest once you're consistently using the passkey rather than defaulting back to the old password.

Which accounts should I set up with a passkey first?

Start with the accounts that would cause the most damage if compromised, since these create a cascading risk to everything else. Your email account is the top priority, since password reset flows for almost every other service go through it. After that, prioritise your password manager (if you use one), your financial logins — banking apps and payment platforms — and any work accounts that could expose your employer's systems if breached. You don't need to migrate every account at once; a gradual rollout starting with these highest-risk accounts is a genuinely effective approach.