Set up passkeys: how to sign in without a password

During setup, your device creates two matching keys. It stores the secret, private key in its protected memory. The public key goes to the online service, for example the shop or the email provider (BSI). When you sign in later, the service sends a random number as a challenge. Your device answers it with a signature that only the private key can produce, and the service checks the answer with the public key. The private key is neither sent nor disclosed in the process (BSI).

This leads to the advantages the BSI lists. A passkey cannot be too simple or too short, you cannot forget it, and it is created quickly and automatically. Because a separate key pair is created for each website and each account, any misuse affects only that one account. And because the browser or operating system checks at every sign-in whether the site really is the one the passkey was created for, it does not work on a fake phishing site (BSI). Even if a convincing email lures you to a fraudulent page, the criminals learn nothing there they could use.

A passkey also works with two factors, they are just barely noticeable. The first is possession of the device holding the private key, the second is your fingerprint, your face or the device PIN. This second factor is only shown to your own device and is not stored with the online service (BSI). Your fingerprint therefore stays on the phone. The table compares the two methods.

The last row is the reason why preparation pays off. A password in your head is not lost along with your phone; a passkey stored only on the phone is. If you think about that beforehand, passkeys mean less work than passwords.

The menus have slightly different names at every service, but the procedure is usually similar. The BSI describes the setup as a one-off step with a few clicks in the security settings of the website or app (BSI). Start with an account you use often, but not the most important one. That way you practise the procedure without much at stake.

The next time you sign in, the service will usually ask whether you want to enter a password or use the passkey. Choose the passkey and confirm with your fingerprint, and the device and service exchange everything needed in fractions of a second (BSI). People who already use passkeys mostly rate this positively: 80 percent (BSI-Verbraucherbefragung 2024) of users found signing in very fast, and 78 percent (BSI-Verbraucherbefragung 2024) found the method self-explanatory and easy to use.

Trust is also high among those who already use the method: 72 percent (BSI-Verbraucherbefragung 2024) of users have high or very high trust in passkeys. For everyone else: try your first passkey calmly before setting one up for your bank or email.

Passkeys are managed by a so-called authenticator. This can be the operating system of your smartphone, tablet or computer, a password manager or a small security key in the form of a USB stick (Verbraucherzentrale NRW). The three options differ in how convenient they are and what happens after a loss.

For many private households the first option is the most practical, because the passkey survives a lost phone. The BSI does point out, however, that copyability and storage in provider clouds come with a certain loss of security; security keys are more cumbersome but keep their advantages for high-security use (BSI). For a private inbox and an online shop, the convenience of cloud backup usually outweighs this.

If you want to switch between an iPhone and an Android phone, clarify beforehand how the passkeys will come along. Changing the operating system can make the transfer cumbersome or even impossible (Verbraucherzentrale NRW). Where a service has kept your password, you can then sign in with it and create a new passkey on the new device.

Banks and payment services follow special rules. The European Payment Services Directive requires strong customer authentication when you access your payment account online or initiate an electronic payment transaction (Art. 97 PSD2). What that means is laid down in the directive’s definitions:

A passkey brings two of these elements: possession of the device holding the private key and your PIN or fingerprint (BSI). Whether and for what a bank uses passkeys is up to the bank. For payments there is an additional rule: for remote payments such as transfers, authentication must dynamically link the transaction to a specific amount and a specific payee (Art. 97 PSD2). That is why your banking app usually shows the amount and payee before you approve, even if signing in itself works without a password. Read these details before every approval.

For online banking this means: a passkey can make signing in more convenient, but it does not relieve you of checking each individual payment. If you are switching anyway, you will find the basics of payee verification and the TAN app in the article Online banking 2026: using payee verification correctly. If you prefer to practise the procedures with support, they are covered in the online banking course.

In the data protection course at your home, we go through your most important accounts together: we check screen lock and updates, decide where your passkeys will be backed up, set up the first passkey with the services that offer it and practise signing in on the PC with your phone. Finally, we write the emergency note with you. If you would rather first get more confident using your smartphone, the smartphone courses are the right place to start.

For older people, the switch can be a relief because there is no password to remember any more. That is exactly when it pays to agree on the emergency route together with relatives. How we go about this is described on the page Tech help for seniors. If you already have a password manager, we build on it; the basics are in the article Setting up a password manager.