Passkeys

The default method. Device-bound, nothing to type.

What they are

A passkey is a key pair held by your device. The private half never leaves it and is released only after the device has confirmed it is you — a fingerprint, a face, or the device PIN. Nothing that can be typed can be phished, which is the whole reason this is the default.

Enrolling a second device

Enrol at least two. A single passkey on a single device is one dropped phone away from a recovery-code conversation. Enrolment for an additional device is done from an already-signed-in session.

If you lose the device

Sign in from another enrolled device and remove the lost one. If it was your only enrolled device, use a recovery code.

Shared and managed devices

Do not enrol a passkey on a device other people can unlock. On a managed device, enrolment may be disabled by policy — that is deliberate and not a fault.

Browser support

Every current browser supports passkeys. If yours is prompting for a password instead, it is usually an out-of-date browser rather than an account problem.