You have probably seen the message by now. Google, Apple, Microsoft, your bank or your favourite shopping site asking: “Would you like to create a passkey?” Most people tap “Not now” because nobody has explained what it actually is.
Here is the short version: a passkey is the biggest step forward in keeping your accounts safe in years, and it is easier to use than a password. But it is not magic, and knowing where it stops is just as important as knowing what it does.
This post is a plain-English summary of a five-part series we have just published. If you want the full detail, links to every part are at the end.
1. What is a passkey?
A password is a secret that you and the website both know. To prove it is you, you hand it over. That is the whole problem: anything that sees your password once, a fake website, a data breach, someone looking over your shoulder, can use it again. And if you use the same password in several places, one leak opens all of them.
A passkey works differently. When you create one, your phone or computer makes a pair of digital keys. One stays locked inside your device and never leaves it. The other goes to the website, and on its own it is useless to a thief. When you sign in, you simply unlock your device the way you normally do, with your face, fingerprint or PIN, and your device proves it is you without ever sending a secret.
Your fingerprint or face never goes to the website. It is checked on your own device, which then says “yes, it’s me”.
Read more: What are passkeys, and how do they actually work?
2. Why fake websites stop working
This is the part that makes passkeys special. Every passkey is tied to one specific website address. If a scammer sends you to a perfect copy of your bank’s login page, your device checks the real address, finds no passkey for it, and simply does nothing.
You don’t have to spot that the website is fake. Your device does it for you, even on a bad day, even when you are tired or rushed.
That is why government security agencies in the United States, the United Kingdom and Australia all now recommend passkeys. The UK’s National Cyber Security Centre said in April 2026 that passkeys should be people’s first choice of login.
3. Synced or stored on one device?
There are two kinds of passkey, and you will meet both.
- Synced passkeys are backed up, securely encrypted, to your Apple, Google or password manager account. Get a new phone and your passkeys come with you. This is what most people will use.
- Device-bound passkeys live on one piece of hardware, such as a small security key on your keyring, and can never be copied. They are extra strong, but if you lose the key, that passkey is gone, so you need a backup.
For most of us, synced passkeys are the right choice. Just remember that the account holding them, usually your Apple or Google account, is now the one to protect most carefully.
Read more: Synced vs device-bound passkeys: how to choose
4. What passkeys stop, and what they don’t
Passkeys shut down some of the most common scams completely: fake login pages, leaked passwords being tried on your other accounts, stolen one-time codes, and SIM-swap scams that intercept your text messages.
But scammers don’t give up. They move to whatever still works, and almost everything that still works relies on persuading a person to do something.
A few examples to watch for:
- “Try another way.” A page claims your passkey isn’t working and offers a code or password instead. That is often the trap.
- “Allow this app access?” A real login screen, followed by an app asking to read your email or files. If you didn’t go looking for that app, say no.
- Fake “I’m not a robot” checks that tell you to press Windows + R and paste something. No real website ever asks you to do this. It installs malware.
- A phone call or message asking you to pay, move money or change bank details. That never needed your password in the first place.
Read more: Which attacks do passkeys stop? and Passkey weaknesses: the attacks that still work
5. Five habits for the passkey era
- Turn on passkeys for your important accounts. Start with your email, because it can reset everything else. Look for “passkeys” in the account’s security settings.
- Be suspicious of “try another way”. Close the page and go to the website yourself.
- Read before you tap Allow. Unexpected requests for your email or files get a no.
- Never paste and run a command a website asks you to.
- Protect the account that stores your passkeys with a strong lock and a recovery option you control.
All five come down to the same simple habit: Stop. Check. Then act.
Read more: Security awareness training after passkeys: what needs to change
Want to know more?
This post is the easy-reading version. The full series, Passkeys explained, goes into how it all works with step-by-step interactive diagrams, what organisations should roll out for their staff, and exactly how each scam works and how to stop it.
Read the full five-part series on Mono Training
Test your own scam-spotting skills in three minutes: ten real messages, one question each, safe to click or bin it?
Have you already switched to passkeys? Did anything confuse you, or has a site asked you to “try another way”? Share your experience below. We’re all in the same boat.