Passkeys and passwordless

A passkey is a sign-in with no password. You unlock your phone or computer the normal way, with a fingerprint, your face or a PIN, and that unlock is the sign-in. There is nothing to phish.

Why it is better

• A password can be guessed, reused or tricked out of you. A passkey only lives on your device.
• A fake sign-in page gets nothing. The passkey only works on the real site.

Getting one on Google

Open myaccount.google.com/signinoptions/passkeys and select Create a passkey. Unlock your device when asked. Only create a passkey on a device you own, because anyone who can unlock it can get into your account.

Getting one on Microsoft 365

Passkeys come with every Microsoft 365 plan at no extra cost. Your organisation has to switch them on first, and we do that for you. Then you add a passkey in the Microsoft Authenticator app, or on a small hardware security key. Microsoft’s admin page has the detail. Email [email protected] and ask for passkeys.

Related

• Turn on multi-factor sign-in, do this first
• Password Manager, for sites that still need a password