Traditional passwords remain the weakest link in personal digital security. Users routinely reuse predictable passwords, store credentials in unencrypted text files, or fall victim to sophisticated credential-harvesting phishing attacks. To eliminate passwords permanently, Google, Apple, Microsoft, and the FIDO Alliance established the Passkey standard. Based on public-key cryptography, passkeys replace passwords and SMS two-factor authentication codes with seamless biometric verification.
In Google Chrome, passkeys are natively integrated into Google Password Manager, allowing credentials to synchronise securely across Windows, macOS, ChromeOS, and Android devices using end-to-end encryption. Here is how passkeys work, how to create them in Chrome, and how to manage your passkey vault.
How Passkeys Protect Against Phishing
Passkeys provide fundamentally superior security compared to traditional passwords:
- Asymmetric Cryptographic Pair: When you create a passkey, your device generates a private key stored securely inside your hardware security module (TPM / Secure Enclave) and sends only a public key to the website server.
- Immune to Phishing: Passkeys are bound cryptographically to the exact domain name in your browser address bar. Even if you accidentally visit a counterfeit phishing website, Chrome will not present your passkey.
- Zero Server Leaks: Because the website never stores your private key, server database breaches cannot compromise your login credentials.
- Biometric Convenience: Log into accounts using Windows Hello (PIN/Fingerprint), Touch ID on Mac, or fingerprint unlock on Android.
Prerequisites for Passkeys in Google Chrome
To use synced passkeys in Chrome, ensure your system satisfies the following:
- Google Chrome: Chrome Version 108 or higher on desktop (Windows 11, macOS, ChromeOS).
- Google Account: Signed into your primary Google Profile with Google Password Manager synchronisation active.
- Screen Lock Configured: A biometric or PIN lock configured on your local operating system.
How to Create a Passkey on a Website
Enabling a passkey on supported websites (such as Google, Amazon, GitHub, PayPal, and X) requires only a few clicks:
- Open Google Chrome and sign into your account on the target website.
- Navigate to the website’s Account Settings > Security section.
- Look for an option labelled Passkeys, Passkeys and Security Keys, or Passwordless Login.
- Click Create a passkey.
- Google Chrome displays an interactive system prompt: “Create a passkey for [website.com]”.
- Choose where to save the passkey: select Google Password Manager to sync it across all your Chrome devices.
- Verify your identity using your device screen lock (Windows Hello PIN or Mac Touch ID).
- Chrome confirms the passkey was created and saved to your Google Password Manager.
Logging In with a Passkey
Once created, logging in is instantaneous:
- Navigate to the website login page.
- Click inside the username or email field.
- Chrome displays your saved passkey in the autofill dropdown.
- Click on your passkey profile, confirm with Windows Hello or Touch ID, and you are signed in immediately—no passwords or OTP codes required.
| Security Factor | Traditional Password + SMS OTP | FIDO2 Passkey in Chrome |
|---|---|---|
| Phishing Resistance | Vulnerable (Credentials can be typed on fake sites) | 100% Phishing-proof (Domain-bound cryptographic origin) |
| Credential Reuse Risk | High (Users recycle passwords across services) | Zero (Unique cryptographic keypair per service) |
| Login Velocity | Slow (Typing passwords, waiting for SMS codes) | Instant (1-touch fingerprint or PIN verification) |
Managing Saved Passkeys in Chrome Settings
To audit, rename, or delete passkeys stored in your browser:
- In Google Chrome, click the three vertical dots in the top-right corner and select Google Password Manager.
- Click Settings in the left sidebar.
- Scroll to Passkeys to review your registered authentication keys.
- Click on any entry to see creation dates and associated devices, or click the trash can icon to revoke a passkey.