Two ideas that often get mixed up
People often talk about passkeys and biometrics as if they were the same thing. They are related, but they do different jobs.
A biometric is a way of proving to your phone that you are the person holding it, using a fingerprint, your face, or sometimes another body feature. A passkey is a type of login credential that replaces a password for a particular website or app. Biometrics are commonly used to approve the use of a passkey, which is why they appear together, but you can have one without the other.
What biometrics do
Fingerprint or face unlock is mostly about convenience with reasonable protection. It lets you unlock the phone quickly without typing a code every time, which makes it more likely that you will keep a strong screen lock turned on at all. That is a real security benefit.
It is also important to know what biometrics typically do not do. They do not usually send an image of your face or fingerprint to the app you are using. On most modern phones, the match happens on the device, and the app receives only a yes or no. Details differ between phones, so it is worth reading your phone maker’s explanation.
The limits of biometrics
Biometrics have some drawbacks that are worth thinking about.
- A password can be changed if it leaks, but you cannot change your face or fingerprint.
- Someone may be able to pick up your phone and hold it to your face or press your finger on it while you are asleep, or may pressure you to unlock it. A passcode is not subject to the same situation.
- Matching is never perfect. Phones sometimes reject the right person or, rarely, accept the wrong one. Some people, such as identical twins or close relatives, may find that matching is less reliable.
- Biometrics fall back to your passcode. If you restart the phone, change certain settings, or fail the scan several times, the phone will ask for the code. So the passcode remains the foundation, and it should be long enough to be hard to guess.
None of this means biometrics are a bad idea. For most people, they are a sensible way to keep a strong lock enabled. But they work best as a convenience on top of a good passcode, not as a replacement for one.
What a passkey is
A passkey is built on a pair of linked digital keys. One key stays on your device, and the other is held by the website or app. When you sign in, your device proves that it holds the private key without ever sending it. Your phone typically asks for your fingerprint, face or screen lock to approve the sign-in.
Because there is no shared secret like a password to type, there is nothing for you to reveal to a fake site. A passkey is tied to the real site it was created for, so it generally will not work on a lookalike page. That makes passkeys resistant to the kind of app phishing that tricks people into typing a password on a copycat page.
What passkeys do well
- They remove the need to invent and remember a password for each supported account.
- They resist phishing, since the passkey only works for the genuine site.
- They cannot be guessed or reused across sites the way passwords can.
- Because the service does not store your secret, a leak from that service is less likely to expose something usable.
What passkeys do not do
Passkeys are not a cure for every problem, and it is worth being realistic.
- Not every service supports them yet, so you will probably continue to use passwords and password managers for some accounts for a while.
- They rely on your device or your account with the platform, so losing access to that account or device can complicate sign-in. Know how your passkeys are stored and backed up, and keep a recovery option available.
- If someone gets into your unlocked phone, or your phone maker account, they may reach your passkeys too. Your screen lock and account security still matter.
- They do not protect you from other kinds of scams, such as being talked into approving a payment or installing something harmful.
Practical advice
If a service offers a passkey, it is usually a good idea to set one up, especially for email and financial accounts. Keep an alternative sign-in method until you are confident that your recovery options work. Where passkeys are not offered, two-step verification is the next best step.
Keep your screen lock strong, because everything else leans on it. Keep your device updated, and make sure you know how to remove access if the device is ever lost. Treat biometrics and passkeys as useful layers rather than guarantees: they make the common attacks harder, and they do not remove the need for sensible habits.