The Fast Identity Online (FIDO) Alliance developed passkeys several years ago, and the technology offers numerous benefits. For example, passkeys cannot be guessed or shared. Also, passkeys resist some phishing attempts because they're unique to the sites they're created for, so they won't work on fraudulent lookalikes. Most importantly, in the age of near-constant data breaches, your passkeys cannot be stolen by hacking into a company's server or database, making the stolen data far less valuable to criminals. //

Apps or websites store your unique public key. A private key is stored on your device, in your password manager, or, if you're an Apple user, in your iCloud keychain. After your device (or iCloud) authenticates your identity, the two keys combine to grant you access to your account. //

To learn how to set up passkeys for your online accounts, check out our guide to setting up and using passkeys.
https://www.pcmag.com/how-to/no-more-passwords-how-to-set-up-apples-passkeys-for-easy-sign-ins

You know the data privacy pop-up screens? Don't immediately tap "Accept." Instead, navigate to the "Cookies" or "User Data" sections and choose the shortest available session duration. That way, your cookies will expire automatically or whenever you close your browser window. //

Because the technologies became popular around the same time, many people seem to believe that 2FA options like biometric authentication, authenticator apps, and hardware security keys are the same as passkeys.

The difference? Passkeys perform multi-factor authentication. You will log into a website using only the passkey; there is no need to enter a password and username. Depending on your privacy and security settings, the iCloud account, device, or password manager where you've stored a passkey may require you to unlock it by using your face, fingerprint, or passcode.