Passkeys explained: what they are and how to use them in Chrome
Passkeys replace passwords with a key that only works on the real website. Here is what that means for you and how to start using them.
You've probably seen websites offering to "create a passkey". Passkeys are the biggest change to signing in for decades, and they're simpler than they sound. Here's what they are and how to use them.
What is a passkey?
A passkey is a way to sign in without a password. Instead of something you type, your device holds a secret key that proves who you are. When you sign in, the website sends a challenge, your device answers it with the key, and you're in.
The key itself never leaves your device and is never sent to the website. The website only stores a matching public key, which is useless to anyone who steals it.
Why passkeys are safer
- Nothing to steal from websites. Hackers who break into a website only find public keys, which can't be used to sign in.
- Phishing doesn't work. A passkey is tied to the real website's address. On a fake site, there is simply no passkey to use, so you can't be tricked into handing it over.
- Nothing to remember or reuse. Each passkey is unique to one website and one account.
Passkeys vs 2FA codes
Passkeys are often strong enough to replace both the password and the second step. But many websites don't support them yet, and many that do still ask for a code as a backup. For now you'll want both: 2FA codes for most accounts, passkeys where they're offered. Twofold keeps both in one encrypted place.
Where do passkeys live?
A passkey has to be stored somewhere: your phone, your computer, a hardware security key or an app that keeps them for you. Twofold stores them in your encrypted vault, right in Chrome, so you can use them without reaching for your phone. If you turn on sync, they follow you to your other computers, still end-to-end encrypted.
How to save a passkey with Twofold
- In Twofold, open Settings and make sure Save passkeys here is on. Chrome asks for permission to work on websites the first time; choose Allow.
- On a website, go to its security settings and choose Create a passkey (sometimes "Add a passkey" or "Use a passkey").
- Twofold shows a Save a passkey? panel with the site and your account name. Choose Save passkey.
That's it. The passkey is now in your vault.
How to sign in with it
- On the website's sign-in page, choose the passkey option ("Sign in with a passkey").
- Twofold shows your saved passkeys for that site. Pick one and you're signed in.
Some sites show passkey suggestions directly in the username field; Twofold works with those too. If your vault is locked, the panel asks for your master password first. You can also require your master password before every passkey sign-in in Settings.
Want to use your phone instead?
Every Twofold passkey panel has a Use another device or browser button. Choose it and Chrome's own options appear, including your phone or a hardware security key. You decide per website.
Good to know
- Twofold stores synced passkeys, like most password managers do. A few high-security services only accept passkeys on a hardware security key; for those, use "Use another device or browser".
- You can see and delete your passkeys any time under Settings → Manage passkeys.
- Your passkeys are included in encrypted backups and sync, so a new computer gets them back.
New to all this? Start with setting up an authenticator in Chrome, then add passkeys as websites offer them.