A passkey is a login that replaces your password. Instead of a secret you type, your device keeps a private key, the website keeps a matching public key, and you prove it's you with your fingerprint, your face, your PIN, or by unlocking your password manager. There's nothing to type, nothing to remember, and nothing a fake website can steal.
Think of it as a lock and a key. The website holds the lock. You hold the only key. Every time you sign in, the website asks you to open the lock, and your device does it without the key ever leaving your hands. The website never learns the key, so a breach of the website doesn't give anyone your login.
What happens when you create one
You sign in to a site the old way, and it offers to create a passkey. You say yes.
- Your device makes a pair of keys: one private, one public.
- The private key stays with you, on your phone, in your browser, in your password manager, or on a hardware security key.
- The public key goes to the website.
- Your device remembers which website the pair belongs to.
That's it. No password is created, so there's no password to reuse on another site.
What happens when you sign in
- The website sends a random challenge, different every time.
- Your device asks you to confirm: fingerprint, face, PIN, or your password manager's unlock.
- Your device signs the challenge with the private key.
- The website checks the signature against the public key it holds. If it matches, you're in.
The fingerprint or face check happens on your device. The FIDO Alliance, which writes the standards passkeys are built on, puts it this way: the server only sees an assurance that the check was successful. It never gets your fingerprint.
Why a passkey can't be phished
Phishing works because a password is the same wherever you type it. A fake login page that looks like your bank collects it and uses it on the real one.
A passkey is tied to the website that created it. Your browser and your device check the address before they sign anything. A passkey made for your bank's real address won't sign in on a lookalike, however good the copy is. You can't hand it over by mistake, because you're never the one handing it over.
That's the part that matters most. Not the convenience. The fact that the most common way accounts get stolen stops working.
Passwords vs passkeys
| Password | Passkey | |
|---|---|---|
| What you do | Type it | Confirm with fingerprint, face, PIN or vault unlock |
| What the website stores | A hash of your password | A public key, useless on its own |
| If the website is breached | Your password may be cracked and tried elsewhere | Nothing an attacker can sign in with |
| Fake login page | Collects it | Refuses to sign in |
| Reuse across sites | Common, and dangerous | Impossible. One passkey per site |
| Can you forget it? | Yes | No, but you can lose the device that holds it |
Where passkeys live
The FIDO Alliance separates them into two kinds.
- Synced passkeys are copied between your devices through a cloud service. Lose your phone and your passkeys are still on your laptop and in your account.
- Device-bound passkeys never leave a single device. A passkey on a hardware security key is the usual example. Very hard to steal, and gone if the device is.
Most people use synced passkeys without thinking about it. Their phone or their password manager offers to save one, and they say yes.
How many people use them
According to the FIDO Alliance's State of Passkeys 2026 report, published in May 2026, there are 5 billion passkeys in active use. In its survey of 11,000 adults across ten countries, including the UK, 90% said they were familiar with passkeys and 75% said they'd turned them on for at least some accounts. That's an industry body reporting on its own standard, so read it as a direction of travel, not an audit.
The downsides, honestly
Passkeys are better than passwords. They're not magic.
- Not every site supports them. You'll have passwords and passkeys side by side for years.
- Moving between ecosystems can be awkward. A passkey saved in one company's system doesn't always follow you to another's. That's one reason people keep them in a password manager instead.
- Synced means stored somewhere. A synced passkey is only as safe as the account it syncs through. That's the trade for not losing it with your phone.
- Device-bound means losable. One hardware key and no backup is a lockout waiting to happen. Register a second way in.
How SecureGate Card handles passkeys
SecureGate Card works as a software passkey authenticator. In practice:
- Chrome extension. When a website asks to create or use a passkey, the extension can answer instead of the browser. It works on any website that supports passkeys. The Chrome extension page covers installing it.
- Android 14 and later. The app registers as a credential provider through Android's Credential Manager. Android 14 lets you turn on third-party providers like this one in the system settings, alongside the built-in one.
- iOS. Not available yet. It's coming, and we'll say so when it ships, not before.
Your passkeys are stored in your vault next to your passwords, and they sync between your devices. They aren't tied to one phone. The keys use ES256, a standard elliptic-curve signature. A site that doesn't accept ES256 won't get a passkey from us.
The vault opens the same way it always does: tap your card on a reader, tap the NFC tag linked to your Android phone, or use email and master password. How passkeys work in SecureGate Card goes into more detail.
What you should know before you store them with us
Synced passkeys have to be stored somewhere, and with us that's our servers. We encrypt your vault with AES-256-GCM using a key we hold. That's not end-to-end encryption. Bitwarden and 1Password both encrypt your data on your device before it reaches their servers, which means they can't read it even if they wanted to. We can't make that claim today, so we won't.
When SecureGate Card fits, and when it doesn't
It fits if you want your passwords, your 2FA codes and your passkeys in one vault, you mostly work in Chrome and on Android, and you like opening that vault with a tap. It fits a small team that wants to move to passkeys without buying everyone a hardware key. Personal is free. Team is €4 per user a month and Business €8, with a 14-day trial, on the pricing page.
It doesn't fit if you're on an iPhone and want passkeys there now. It doesn't fit if you need device-bound passkeys for compliance. That's a hardware security key. And it doesn't fit if your rule is that the provider must never be able to read your vault. For that, use Bitwarden or 1Password.