Most account takeovers do not involve anyone guessing a password. They involve someone handing it over. A convincing login page, a well-timed text, a “verify your account” prompt after a fake brand inquiry, and the password plus the six-digit code go straight to the attacker.

Passkeys end that particular game. Not because they are harder to guess, but because there is nothing to hand over.

What a passkey actually is

A passkey is a pair of cryptographic keys created on your device when you enroll. One half stays on the device, locked behind your face, fingerprint or device PIN. The other half goes to the website. When you sign in, the site sends a challenge, your device signs it with the private half, and the site checks the signature against the public half it already holds.

You never type anything. There is no secret moving across the wire that a third party could capture and replay. The standard behind this, FIDO2 and WebAuthn from the FIDO Alliance and the W3C, is the same technology hardware security keys have used for years. Passkeys put it in the phone you already carry.

Why it cannot be phished

A passkey is bound to the exact domain it was created for. If you enrolled on instagram.com, your device will only ever sign a challenge from instagram.com. A lookalike at “instagram-verify.com” cannot ask for it, and your phone will not offer it. The browser enforces this, not your attention span.

Compare that to a password and an authenticator code. Both are strings you read and type, and a fake page can relay them to the real site in seconds. That real-time phishing attack defeats most two-factor setups. It does not defeat a passkey, because there is no string to relay.

How it stacks up against what you have now

  • SMS codes. The weakest option. Vulnerable to SIM swaps, carrier social engineering and plain phishing. Better than nothing, worse than everything else.
  • Authenticator apps. A real improvement. Immune to SIM swaps, but still phishable in real time, and still a shared secret that lives on a seed you may have backed up somewhere careless.
  • Hardware security keys. Phishing-resistant, same cryptography as passkeys, but a physical object you can lose or leave in another city.
  • Passkeys. Phishing-resistant, synced across your devices through iCloud Keychain, Google Password Manager or a password manager, and unlocked with the biometric you use a hundred times a day.

The practical answer: passkeys daily, a hardware key as backup on the two or three accounts that matter most, and SMS removed wherever the platform allows.

Where to turn it on

Google, Apple, Microsoft, Meta, TikTok and X all support passkeys. The menus move around, but the path is consistent: account settings, then security or password and security, then passkeys.

  • Google: myaccount.google.com, Security, Passkeys and security keys. Also enable “Skip password when possible.”
  • Apple: Your Apple Account uses device-based sign-in by default; passkeys for third-party sites are stored in iCloud Keychain and show up in Settings under Passwords.
  • Meta (Instagram and Facebook): Accounts Center, Password and security, Passkey.
  • TikTok: Settings and privacy, Security and permissions, Passkey.
  • X: Settings and privacy, Security and account access, Security, Additional password protection, Passkey.

What happens if you lose your phone

If your passkeys sync through iCloud Keychain or Google Password Manager, they are restored to your replacement phone when you sign in to that account. The passkey is not trapped in the lost hardware. The lost hardware cannot use the passkey either, because it is locked behind your biometric or device passcode. Use Find My or Find My Device to remotely wipe it anyway.

The real risk is a circular lock: your Google or Apple account is the thing that restores your passkeys, and you need a device to get into it. That is why you keep two things in a safe place:

  1. A hardware security key enrolled on your Google or Apple account and on your most important platform accounts.
  2. Printed recovery codes for those same accounts, stored somewhere physical, not in a notes app.

With those two items, a lost phone is an errand.

The 20-minute rollout

Do this in order. Each step protects the next.

  1. Minutes 0 to 5: the recovery email. Add a passkey to the Gmail, iCloud or Outlook account that every other service uses for password resets. Download and print recovery codes. Remove your phone number as a recovery option if you have a hardware key or codes in place.
  2. Minutes 5 to 8: Apple or Google device account. Confirm trusted devices are only devices you currently own. Remove the old iPad.
  3. Minutes 8 to 15: the money platforms. Instagram, TikTok, YouTube (through Google), X. Add a passkey on each. Where the platform allows you to remove SMS as a second factor, remove it.
  4. Minutes 15 to 18: your password manager. If it stores passkeys, enable that. This is where synced passkeys live for many people.
  5. Minutes 18 to 20: audit the sessions. On each platform, review logged-in devices and sign out anything you do not recognize. A passkey does not evict an attacker who is already inside.

Schedule a second pass for banking, your domain registrar and team tools. Those take longer because other people are involved.

What passkeys do not fix

Passkeys do not stop malware that steals a logged-in session cookie from your browser, and they do not stop a team member misusing access they legitimately hold. What they remove is the single most common way accounts are lost: a person typing a secret into the wrong box. For anyone whose name is worth impersonating, that attack arrives weekly. Shutting it down is the best twenty minutes you will spend this quarter.

Where ShutOut comes in

We run this rollout with clients and their teams, including the uncomfortable parts: finding the forgotten recovery phone number, enrolling hardware keys for the manager who travels, and setting up the printed codes so they exist somewhere other than a screenshot. Then we verify it held, because a security setting nobody checks tends to drift back.