Your mission: Protect your identity with passkeys | Cyber Smart Week 2026

Agent, your mission is simple: keep cyber criminals out of your accounts. Your secret weapon? A passkey.
 
Think of a password as a door code. If someone finds out what it is, they can try to open the door. A convincing fake sign-in page can trick you into giving away that code.
 
A passkey is more like a physical key. Someone can watch you unlock a door, but that doesn't mean they have the key to get in.

How does a passkey work?

Every good secret agent needs a secure way to access classified information.
 
Think of a website as a lock and your passkey as the matching key. When you sign in, your passkey proves you have the right key without giving it away.
 
A passkey has two sections:

• A public section that the website holds
• A private section that's protected by your device or passkey provider

When you sign in, the website checks that the two parts match, but it never receives your private key. This means that even if a cyber criminal steals the website's public part, they can't use it to sign in to your account.
 
Your browser also checks that you're signing in to the correct website. A fake website can't use a passkey created for the real one, making passkeys much harder to steal through phishing scams.
 
Passkeys can also make signing in quicker and easier.

Using your passkey

Even secret agents need to prove who they are.
 
When you sign in with a passkey, you'll usually confirm it's you using your fingerprint, face recognition, or device PIN.
 
Your fingerprint or face recognition is called a biometric check. This happens on your device, so the website doesn't receive your fingerprint, face information or PIN.
 
It's important to know that your fingerprint, face, or PIN unlocks your passkey so it can be used - it isn't the passkey itself.
 
Some passkeys stay on your device, and others can be synced through a provider like iCloud Keychain or Google Password Manager. Before setting up a passkey, check where it will be saved and which devices you'll be able to use it on. You may already have what you need without buying anything extra.

Keep a way back in
 
Every good agent has a backup plan. Your online accounts should be no different.
 
Before relying on a passkey, make sure you have another way to get back into your account - it's a good idea to have backup options in case you lose your phone or can't access your passkeys.
 
Follow the service’s recovery instructions, keep recovery details current, and store any backup codes privately somewhere you can reach without the lost device.
 
Adding a passkey doesn't always remove your password. If your account still uses a password, make sure it's long and unique password and you've turned on multi-factor authentication (MFA). Don't delete a passkey before you know its replacement works.

Today’s five-minute action

Your mission, should you choose to accept it, is to set up a passkey on one of your personal accounts.
 
For personal accounts, save passkeys on your own device or in a personal password-manager account.
 
On your personal phone, tablet, and laptop device:

• Open a website or app (like iCloud or Gmail) and look for ‘Passkeys’ under security or sign-in settings.
• Read the instructions, including how to recover your account if you lose access.
• Check where the passkey will be saved.
• If passkeys are available and you know how you'll recover the device, give it a go!

Not every website offers passkeys yet, and the set-up instructions will be different for every website, browser and device.
 
For personal accounts, use your own device or a personal password manager to store your passkeys. If you're not ready to set a passkey up now, make a note to try it at home.