How to set up passkeys on your Google, Microsoft and Apple devices

A passkey lets you sign in with the same fingerprint, face scan or PIN you use to unlock your phone or computer, instead of typing a password. Because a passkey is tied to the real website or app it was made for, it cannot be typed into a fake login page, which takes away the main tool used in phishing. This guide walks through setting up passkeys for a Google Account and a personal Microsoft account, and storing them in Apple's Passwords app on an iPhone, iPad or Mac.

The Canadian Centre for Cyber Security (Cyber Centre) strongly recommends phishing-resistant sign-in based on the FIDO standards, which is what passkeys use. They are one of the easiest ways for an individual to get there. You can keep your password as a backup while you get used to them.

Before you start

• Update your devices. Google lists Windows 10 or later, macOS Ventura or later, ChromeOS 109 or later, Android 9 or later and iOS 16 or later as supported, with Chrome 109, Safari 16, Edge 109 or Firefox 122 and newer browsers.
• Turn on a screen lock. A passkey is only as safe as the device that holds it. Set a PIN, passcode, fingerprint or face unlock.
• On Apple devices, turn on iCloud Keychain and two-factor authentication for your Apple Account. Apple says both are required to use passkeys. On an iPhone, go to Settings, tap your name, then iCloud, then Passwords (labelled Passwords and Keychain on some versions) and make sure syncing is on.
• Do not create passkeys on a shared or public computer. Use your own phone instead (see Step 4).

Step 1: Create a passkey for your Google Account

1. On the phone or computer you want to use, go to myaccount.google.com/signinoptions/passkeys and sign in.
2. Select Create a passkey, then Create a passkey again to confirm.
3. Unlock your device when prompted, using your fingerprint, face or screen lock PIN.
4. Repeat on each device you regularly use. On an iPhone or Mac, the passkey is saved to iCloud Keychain. On Android, it is saved to Google Password Manager.

To store a Google passkey on a hardware security key instead, choose Create a passkey, then Use another device, and follow the prompts to insert the key and touch it or enter its PIN. Google says the key must support FIDO2.

If your Google Account is run by an employer or school through Google Workspace, your administrator may not allow passkey-only sign-in. Google says you can still create a passkey as a second step or for account recovery.

Step 2: Create a passkey for your Microsoft account

These steps apply to a personal Microsoft account (Outlook.com, Hotmail, Xbox, Microsoft 365 Personal or Family). Work accounts are managed by your organization's administrator.

1. On the device where you want the passkey, sign in to Microsoft's Advanced security options page at account.live.com/proofs/manage.
2. Select Add a new way to sign in or verify.
3. Choose Face, Fingerprint, PIN, or Security Key.
4. Follow the prompts on your device. Select Continue or Create to save the passkey in the suggested place, or Change or Save another way to pick a different spot.
5. Unlock with your face, fingerprint or PIN to finish.

Microsoft lists several places to keep the passkey: a synced password manager, an iPhone, iPad or Android phone (you scan a QR code, and Bluetooth may need to be on), a physical security key, or Windows Hello on the PC itself. A synced option is usually best, because the passkey follows you to a new device.

Once you are comfortable, Microsoft also offers a Passwordless account setting on the same security options page. Turning it on removes the password from your account. Microsoft requires the Microsoft Authenticator app (or Outlook for Android) for this, and, if two-step verification is on, access to two recovery methods. Set up recovery methods first so you are not locked out.

Step 3: Save and use passkeys on an iPhone, iPad or Mac

Your Apple Account itself is protected by two-factor authentication and, optionally, physical security keys. For other websites and apps, Apple stores passkeys in the Passwords app and syncs them through iCloud Keychain, which Apple describes as end-to-end encrypted.

1. Go to the sign-in screen of a website or app that supports passkeys.
2. For a new account, follow the sign-up steps. For an existing account, sign in with your password and open the account or security settings.
3. When you see the option to save a passkey, tap Continue. Apple notes that if no passkey option appears, the site does not support passkeys yet.
4. Next time, tap the account name field, choose the suggested account and confirm with Face ID, Touch ID or your passcode.

To see or delete passkeys, open the Passwords app and tap Passkeys. To remove one, tap the account, tap Edit, then Delete and Delete Passkey.

Step 4: Sign in on a computer that is not yours

You do not need to create a passkey on a borrowed or library computer. Apple and Google both support signing in with your phone:

1. On the other computer, enter your user name on the sign-in page.
2. Choose Other options, Passkey from nearby device, Use another device or similar wording. A QR code appears.
3. Scan the code with your phone's camera and approve with your face, fingerprint or PIN. Bluetooth must be on, because the phone checks that it is physically near the computer.

Sign out when you are done. Nothing is left behind on the other computer.

Step 5: Keep a way back in

• Have at least two passkeys or methods per account. For example, a synced passkey on your phone and a hardware security key in a drawer.
• Keep recovery details current. Check the recovery phone number and email on your Google and Microsoft accounts, and consider an Apple account recovery contact.
• Review your list after losing a device. Remove passkeys tied to a lost or sold phone from the account's security page.
• Treat passkey prompts like a door key. Only approve a sign-in you started yourself.

What to do if something goes wrong

If you cannot sign in with a passkey, use the "try another way" or "sign-in options" link to fall back to your password or another verified method, then re-create the passkey. If you suspect someone else got into an account, change the password, remove unknown passkeys and devices from the security page and review recent activity. If money or personal details were taken, report it to your local police and to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca or 1-888-495-8501.

Sources

• Google Account Help: Sign in with a passkey instead of a password
• Microsoft Support: Signing in with a passkey
• Microsoft Support: Go passwordless with your Microsoft account
• Apple iPhone User Guide: Use passkeys to sign in to websites and apps on iPhone
• Apple Support: About the security of passkeys
• Canadian Centre for Cyber Security: Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)
• Canadian Anti-Fraud Centre: Reporting fraud