Body
What are passkeys?
Passkeys are the future of signing in—simple, secure, and stress-free.
No typing, no guessing, no “forgot password” drama. With passkeys, you don't need to create and remember passwords. Instead of typing a password, you use your phone or device to confirm it’s really you, using your face or a fingerprint.
Why do passkeys matter?
Passkeys are incredibly easy to use and intuitive, eliminating the need for complicated password creation processes and the hassle of remembering them.
Also, passkeys are unique to each website or application, so you don't have to worry about someone using your passkey to access other services. And unlike passwords, passkeys are resistant to phishing attempts, making them a much more secure option.
Are passkeys the replacement for passwords?
Yes, passkeys are designed to replace passwords. You can think of passkeys as the evolution of passwords: instead of remembering (or writing down!) your complex passwords, a passkey is linked to your device (for example, your computer or your phone).
When you want to sign in to a website or application, your device acts like a magic key. No need to type anything, just use your device, and it works! Passkeys are like digital keys that make signing in easier and safer.
How does authentication with passkeys work?
Instead of sending a password over the Internet, your device generates a pair of keys: a private key and a public key.
- The private key is stored securely on your device.
- The public key is registered with the website or application.
When you want to sign to the website or application, your device has to prove that it has the private key. After you unlock your private key, your device digitally signs a challenge from the website or application. The website or application verifies the signature using the public key and grants you access.
Are passkeys considered multi-factor?
Yes, passkeys are considered a form of multi-factor authentication. When you use a passkey, you must use a device that stores the passkey (something you have) and unlock it with biographic information or a PIN (something you are, or something you know).
Are passkeys phishing resistant?
Yes, passkeys are phishing resistant. When they are created, passkeys are associated with the specific domain that the website or app are registered with. A passkey created for netflix.com can only be used with netflix.com. While a user can be tricked into landing on a similar looking website, they can't present their passkey to the malicious website. Their device won't allow it.
Can I use passkeys across multiple devices?
Yes, you can use passkeys across multiple devices. Synced passkeys allow you to use your passkey anywhere the provider is. On Windows you can use Microsoft Password Manager or a third-party provider to save and use passkeys created on other devices.
In addition, you can use cross device authentication: a passkey might be stored on one device, and you can use it for sign-in on another device through a QR code that is generated on the device where you want to sign in. During this process, a proximity check takes place to ensure that the passkey is only being used for authentication on a device that's nearby. With this technology, you can rest assured that your passkey can't be used by a remote attacker to gain access from far away.
What is Microsoft Password Manager?
Microsoft Password Manager is Microsoft's password and passkey management solution.
You can create, view, and edit passwords and passkeys, run password security checks, and access other password and passkey autofill options.
Learn how to view or edit your passwords in Microsoft Edge.
Why doesn't my Windows device have some of the passkey's options described in the article?
Your device may not support, or may need to be updated, to support passkeys. Contact the Call Center for assistance.
Can I have multiple passkeys in Authenticator?
You can have only one passkey for each account in Authenticator. At this time, Authenticator only supports passkeys for Microsoft Entra ID.
Can I use passkeys in Authenticator without an internet connection?
You can't use passkeys without an internet connection.
I stored my passkey in the Microsoft Authenticator app in my Android personal profile and I can't use it in my work profile?
This behavior isn't specific to the Microsoft Authenticator app. Android Work Profile intentionally creates two isolated environments (personal and work). Contact the Call Center for assistance.
Why do I get prompted for PIN instead of biometric sign-in on my Android device?
If biometric sign-in fails on an Android device, the Authenticator app prompts you to enter your PIN instead. The next time you sign in with the passkey, Authenticator continues to request the PIN rather than biometric sign-in. Authenticator periodically retries biometric sign-in. If biometric sign-in succeeds, it's used for subsequent sign-ins.
What happens to my passkey after I change my PIN or biometric sign-in on my Android device?
Your passkey is invalidated if you change your PIN, or if you change your biometric sign in from thumbprint to face, or vice-versa. If your passkey is invalidated, you need to sign-in by using a different method, and then create a new passkey.