How to Set Up and Use Passkeys on Android with Google Password Manager for Passwordless Sign-In

Traditional passwords remain the weakest link in consumer and enterprise digital security, vulnerable to phishing campaigns, credential stuffing, and third-party database breaches. To replace passwords permanently, the FIDO Alliance and World Wide Web Consortium (W3C) established the Passkey standard based on public-key cryptography. On Android devices, Google Password Manager natively creates, synchronises, and protects passkeys using end-to-end encryption. With passkeys, you authenticate on compatible websites and mobile apps using your device’s biometric sensors (fingerprint or face unlock) or screen lock PIN—without ever typing a password.

How Passkeys Protect You Against Phishing

Passkeys rely on cryptographic key pairs:

• Public Key: Stored on the website’s authentication server. It contains no secret data and is harmless even if the server suffers a breach.
• Private Key: Stored securely on your Android device inside the hardware-backed Trusted Execution Environment (TEE) or Titan security chip.

During login, the web server sends a cryptographic challenge. Your device signs the challenge using the private key only after you authenticate biometrically. Because passkeys are cryptographically bound to the exact registered domain name, you cannot be tricked into signing in on a fake phishing URL—the browser will simply refuse to present the passkey.

Prerequisites for Using Passkeys on Android

Ensure your device meets the standard requirements:

• A smartphone running Android 9.0 (Pie) or higher.
• A secure screen lock configured (Fingerprint, Face Unlock, PIN, or Pattern).
• Google Play Services updated to the latest release.
• Bluetooth enabled (required when using your phone as a passkey to sign in to external laptops or desktop computers).

Creating a Passkey on a Supported Website or App

Major services including Google, Amazon, Microsoft, WhatsApp, GitHub, and PayPal support passkeys. To register a passkey:

1. Open the website or app (e.g., your Google Account security page at myaccount.google.com).
2. Navigate to the account’s Security or Sign-in Options settings.
3. Select Create a passkey (or Passkeys and Security Keys).
4. Android displays a system dialog stating: “Create a passkey for [website] – Saved to Google Password Manager”.
5. Tap Continue and scan your fingerprint or enter your screen lock PIN.

Your passkey is generated instantly and synchronised encrypted across all devices connected to your Google account.

Signing In with a Passkey on Your Android Phone

Once created, logging in takes seconds:

1. Navigate to the sign-in page of the service.
2. Tap the username field. Google Password Manager prompts you with your saved passkey credential.
3. Tap your account handle.
4. Scan your fingerprint or complete biometric verification.
5. You are instantly signed in without entering a password or waiting for two-factor SMS codes.

Using Your Android Device to Sign In on a Desktop Computer

You can also use your Android phone as a physical security authenticator to log in to websites on a Windows PC, Mac, or Linux computer running Chrome or Edge:

1. On your desktop browser, select Sign in with a passkey.
2. Choose the option Use a phone, tablet, or security key.
3. The desktop screen displays a secure QR code.
4. Open the camera app on your Android phone and scan the QR code.
5. Verify the prompt on your phone and authenticate with your fingerprint. The desktop session logs in automatically over an encrypted local Bluetooth handshake.

Managing and Deleting Passkeys in Google Password Manager

To audit or revoke passkeys stored on your device:

1. Open Settings on your Android phone.
2. Navigate to Google > Password Manager (or Passwords, passkeys & autofill).
3. Under the Passwords tab, select an account entry.
4. Authenticate using your biometric lock.
5. Active passkeys appear alongside traditional credentials. Tap Delete passkey if you need to revoke access on that service.

Passkeys vs Two-Factor Authentication (2FA) Comparison

Security Attribute	Password + SMS 2FA	FIDO2 Passkeys
Phishing Resistance	Vulnerable to reverse proxies and fake landing pages	Immune; cryptographically domain-bound
SIM Swapping Vulnerability	High risk via cellular provider interception	Zero risk; private key never leaves secure enclave
Sign-in Speed	Slow; requires waiting for code and copy-pasting	Instant; single biometric tap
Server Breach Risk	Compromised hashes can be cracked offline	Zero risk; servers store only useless public keys