How to Set Up Passkeys on Your iPhone and Android in Australia

Passwords are the weakest part of most people's online security. They get leaked in breaches, reused across sites and guessed by criminals. Passkeys fix that problem by replacing the password with a check on your own phone, usually your fingerprint or your face. They are faster to use and cannot be phished, and they are now built into iPhone and Android. This guide shows you how to set them up, starting with the accounts that matter most.

What a passkey actually is

A passkey is a pair of digital keys that replaces your password. One key stays on your phone and never leaves it. The other key is stored by the website or app you sign in to. When you sign in, your phone proves it holds the matching key, and you confirm it is really you with your fingerprint, your face or your PIN. There is nothing to type and nothing to remember.

Because the private key never leaves your device, a criminal cannot steal it from a company database the way they steal passwords. And because a passkey only works on the real website it was created for, a fake login page cannot trick you into handing it over. On iPhone they live in iCloud Keychain, and on Android in Google Password Manager.

Step 1: Turn on the basics on your phone

Before you create your first passkey, make sure your phone is ready. On iPhone, open Settings, tap your name at the top, then iCloud, then Passwords, and make sure Sync this iPhone is turned on. You also need a screen lock set up, either Face ID, Touch ID or a passcode, because that is what confirms it is you when you use a passkey.

On Android, open Settings, then Google, then Password Manager, and check that you are signed in to your Google account. Make sure your phone has a screen lock as well, either a fingerprint, face unlock or PIN. Without a screen lock, your phone cannot create passkeys at all, so set one up first if you have been putting it off.

Step 2: Create a passkey for your Google account

Start with Google, because your Google account is the key to your email, your photos and your Android phone. On your phone, open a browser and go to myaccount.google.com, then sign in with your password one last time. Tap Security, then look for Passkeys and security keys, and tap Create a passkey. Your phone will ask you to confirm with your fingerprint, your face or your PIN, and that is it. The passkey is saved.

Next time you sign in to Google, you will be prompted to use your passkey instead of typing a password. On a computer, you can sign in with the passkey on your phone by scanning a code on the screen.

Step 3: Create a passkey for your Apple ID

On iPhone, open Settings, tap your name at the top, then Sign-In and Security. If your Apple ID offers a passkey option there, follow the prompts to create one. On newer versions of iOS, your Apple ID may already be using a passkey automatically when you sign in with Face ID or Touch ID.

The important thing is to make sure iCloud Keychain is syncing, so the passkey is backed up to your other Apple devices. If you lose your iPhone, you can recover your passkeys by signing in to iCloud on a new device, as long as you know your Apple ID password and can pass Apple's account recovery checks.

Step 4: Create a passkey for your Microsoft account

If you use Outlook, Office, OneDrive or a Windows computer, set one up for Microsoft too. Go to account.microsoft.com in your browser, sign in, then open Security and look for the option to add a passkey or a new way to sign in. Follow the prompts, confirm with your fingerprint, face or PIN, and the passkey will be saved to your phone.

Microsoft may also offer the Authenticator app to store passkeys, but the passkey in your phone's own password manager works just as well.

Step 5: Add passkeys to your other accounts

Then work through your other important accounts. Banks, social media, shopping and government services are adding passkey support steadily, and MyGov is worth checking too. On each site, look in the security or sign-in settings for an option labelled Passkey, or Add a passkey, or Sign in with a passkey. If you cannot find it, that service may not support passkeys yet. In that case, keep a strong unique password and two-factor authentication turned on for it.

Keep your old password and two-factor authentication as a backup until you are confident the passkey works.

Step 6: Plan for a lost or broken phone

Passkeys synced through iCloud Keychain or Google Password Manager are backed up to your account, so you can recover them on a new device by signing in. Recovery depends on getting into your Apple ID or Google account, so keep a recovery phone number and email address on both, and check them once a year.

If your phone is stolen, sign in from another device as soon as you can and use Find My or Find Hub to lock or erase it. Your passkeys are protected by your screen lock, so a thief cannot use them without your fingerprint, face or PIN.

Frequently Asked Questions

Are passkeys safer than passwords?

Yes. A passkey cannot be guessed, leaked in a data breach or stolen by a phishing site, because the private key never leaves your phone and it only works on the real website it was made for. Passwords can be all three. Passkeys are quicker, since signing in takes a fingerprint or a glance instead of typing.

What happens to my passkeys if I switch from iPhone to Android?

In most recent versions, you can transfer passkeys when you set up the new phone, or create new ones for your main accounts on the new device. Keep your old phone until you have confirmed the new one signs in everywhere you need.

Do I still need a password at all?

For now, yes, for some accounts. Many services keep your password as a backup, and some do not support passkeys yet. Keep a strong unique password in a password manager for those accounts, and turn on two-factor authentication where it is offered. Over time, more services will let you go password-free.