{"id":16530,"date":"2025-09-03T11:05:48","date_gmt":"2025-09-03T11:05:48","guid":{"rendered":"https:\/\/topat10.com\/?p=16530"},"modified":"2025-09-03T11:05:48","modified_gmt":"2025-09-03T11:05:48","slug":"what-is-a-passkey-heres-how-to-set-up-and-use-them-2025","status":"publish","type":"post","link":"https:\/\/topat10.com\/?p=16530","title":{"rendered":"What Is a Passkey? Here\u2019s How to Set Up and Use Them (2025)"},"content":{"rendered":"


\n<\/p>\n

\n

With a password, there\u2019s a ton of room for an attacker to potentially steal your password. Data breaches might expose your password, and even if it\u2019s encrypted, it can be cracked. Phishing schemes are an easy vector of attack for hackers looking to steal passwords. And, if you\u2019re using a service with spotty security practices, you could have a password exposed as plaintext in a breach; there are dozens and dozens of examples<\/a> of this happening before.<\/p>\n

Passkeys vs. 2FA and MFA<\/h2>\n<\/p>\n

Passkeys are tricky because they fly in the face of security conventions that have been around for years\u2014namely, two-factor (2FA) or multifactor authentication (MFA). Although you don\u2019t need to plug in a code from a text or copy something over from an authenticator app, passkeys inherently use multifactor authentication. It just happens so fast that it\u2019s easy to miss.<\/p>\n

MFA is about adding additional layers of protection beyond your password. Instead of just your password, you need it and a code texted to you, for example. Passkeys already work that way. You need to match the public-private key pair, but you also need to authenticate that you have access to that private key, usually with biometrics. It\u2019s not \u201csomething you know and something you own,\u201d as 2FA is normally described, but it\u2019s still two layers of authentication.<\/p>\n

Here’s how Shikiar describes it: \u201cWhen you sign in, the service issues a cryptographic challenge that can only be answered with the private key on your device, verified by something you have (like your phone or laptop) and often something you are (like a biometric). The result is a phishing-resistant login with no reusable credentials to steal.\u201d<\/p>\n

Devices and Browsers That Support Passkeys<\/h2>\n<\/p>\n

Passkeys are broadly integrated at an operating system level. If you\u2019re using an OS that doesn\u2019t natively support passkeys\u2014i.e., Linux\u2014you can still use them. However, you\u2019ll need to use another device, like your phone, to scan a QR code and authenticate yourself, or a third-party password manager.<\/p>\n

Here are the operating systems that fully support passkeys:<\/p>\n

Each one of these operating systems supports passkeys for native apps, as well as in your browser. Chromium supports passkeys, which covers the vast majority of browsers available, including Brave, Opera, Vivaldi, and Google Chrome<\/a>. The major non-Chromium browser, Mozilla Firefox, also supports passkeys on version 122 or newer.<\/p>\n

How to Create and Store Passkeys<\/h2>\n<\/p>\n

To use passkeys, you need to store them somewhere. The major operating systems that support passkeys already include a way to store them, but they aren\u2019t created equally.<\/p>\n

\n

Windows 10 and Windows 11<\/p>\n<\/div>\n

\n