Users manage their own passkeys from the Passkeys card on their account page.
Creating one
- The user chooses to add a passkey and gives it a nickname — "work laptop", "iPhone" — so a list of several makes sense later.
- Their browser asks them to confirm with their fingerprint, face, device PIN or password manager.
- The passkey is created and stored against their account.
Signing in
On the login page, a user with a passkey can sign in without a password. They confirm with their device and they are in — with exactly the same access a password sign-in gives.
Where passkeys live, and why it matters
- Built into the device (iCloud Keychain, Google Password Manager, Windows Hello) — usually syncs across the user's own devices, so one registration covers their phone and their laptop.
- A hardware security key (a YubiKey or similar) — does not sync. Works anywhere it is plugged in, and is gone if the key is lost.
- A password manager — syncs according to that product's own rules.
Encourage users to register more than one, particularly if they use a hardware key. A single passkey on a single device is a single point of failure.
Advice worth passing on
- Name them usefully — three entries called "Passkey" help nobody.
- Remove passkeys for devices you no longer have.
- Keep the account password current; it is the fallback.