How to Set Up Passkeys on Google, iPhone, WhatsApp and Microsoft
Think about how many times you hit "Forgot password" this month, or how many accounts share the same password because remembering a dozen different ones is not realistic. That is the problem passkeys are built to solve. Instead of typing a secret that can be guessed, reused or phished, you unlock your phone with your fingerprint, your face or your screen PIN, and the phone signs you in.
This guide walks through setting up passkeys on a Google account, on an iPhone, in WhatsApp and on a Microsoft account, and then answers the question most people ask first: what happens if I lose my phone?
What a passkey actually is, and why phishing fails against it
A passkey is not a hidden password. It is a pair of cryptographic keys. The private key stays on your device and never leaves it; the public key is stored by the service, whether that is Google, WhatsApp or Microsoft. When you sign in, your device asks for your fingerprint or face to confirm it is you, then uses the private key to sign the login request.
The crucial detail is that a passkey is tied to the real address of the website or app that created it. If a text message scares you into opening a fake page that looks exactly like Google, your passkey simply will not work there, because the page is not Google. That is why passkeys are considered one of the strongest defences against phishing, which remains the most common way accounts get stolen.
Your biometric data does not travel either. Apple and WhatsApp both stress that face and fingerprint data stay on the device; the server only receives a digital signature.
Before you start: three things you need
- A screen lock on your phone (fingerprint, face or PIN). Without one, no platform will let you create a passkey.
- A password manager that is switched on. On iPhone that is iCloud Keychain; on most Android phones it is Google Password Manager. This is where passkeys are stored and synced.
- A personal device. Google explicitly advises against creating a passkey on a shared device, since anyone who can unlock that device could get into your account.
How to set up a passkey on your Google account
Google was one of the first big companies to offer passkey sign-in for ordinary Gmail accounts, and the process takes about a minute:
- On the device you want to use, open a browser and go to g.co/passkeys. It takes you to the passkeys page in your account settings.
- Sign in if prompted. You may be asked for your current password one more time to confirm it is you.
- Choose Create a passkey and continue.
- Unlock your device when asked, and the passkey is saved.
The same page lists every passkey on your account, so you can remove the one belonging to a phone you sold or lost. If your account is managed by an employer or a school through Google Workspace, the administrator may not allow passkey-only sign-in, and that decision sits with them.
Passkeys on iPhone and iPad
There is no single switch that turns passkeys on for everything on iPhone, because each passkey is created inside the app or website that supports it. What must be on first is iCloud Keychain:
- Open Settings and tap your name at the top.
- Go to iCloud, then Passwords and Keychain, and make sure it is enabled.
- When a site or app offers to create a passkey, accept and confirm with Face ID or Touch ID.
According to Apple's support guide, passkeys sync through iCloud Keychain across every device signed in with the same Apple Account, and they are end-to-end encrypted, so Apple itself cannot read them. To sign in on a computer that is not an Apple device, pick the option to use a passkey from a nearby device; a QR code appears, you scan it with your iPhone camera, and Bluetooth needs to be on for both devices.
A question that comes up a lot: if you do not see a passkey option on a particular site, it usually means the site does not support passkeys yet. It is not a fault with your phone.
How to create a passkey in WhatsApp
WhatsApp added passkeys to protect the moment you set up your account on a new phone, so you are no longer relying only on the SMS code that scammers love to request with the classic "I sent my code to you by mistake" message. Based on hands-on reports from tech publications, the path looks like this:
- Open WhatsApp and go to Settings.
- Tap Account, then Passkeys.
- Tap Create passkey, then Continue, and confirm with your screen lock.
The passkey is saved in your phone's default password manager. There is no edit button: to change it, you go back to the same menu, delete the current passkey and create a new one. Menu wording can differ slightly by phone and app version, but the route is always Account, then Passkeys.
One reminder: a passkey does not replace WhatsApp's two-step verification six-digit PIN. Turning on both is the safer setup.
Passkeys on a Microsoft account (Outlook, Hotmail, Windows)
Your Microsoft account unlocks Outlook mail, Windows, OneDrive and even Xbox, so two minutes spent protecting it are well spent:
- Sign in to Advanced security options for your account, on the device where you want the passkey stored.
- Choose Add sign-in method.
- Select Passkey, or the passkey option inside Microsoft Authenticator if you use that app.
- Follow the prompts on your device and confirm with your fingerprint, face or PIN.
To remove an old passkey, return to Advanced security options, pick it from the list of ways to prove who you are, and choose Remove. If a third-party password manager is installed in your browser, it may pop up and offer to save the passkey instead of Windows; decide on purpose where you want it kept.
What happens if your phone is lost or stolen?
This is the number one reason people hesitate, and the answer is reassuring as long as you prepare before anything goes wrong:
- Passkeys stored in iCloud Keychain or Google Password Manager sync with your account, so they come back on a new phone once you sign in and recover the account.
- A thief cannot use a passkey without unlocking the screen, so choose a PIN that is hard to guess, not 123456 or your birthday.
- Delete the lost device's passkey straight away from Google's passkeys page or Microsoft's security options.
- Keep recovery details current: a backup phone number and a secondary email. Do not remove your old password from an account unless the service supports that and you are sure you have a fallback.
Common mistakes with passkeys
- Creating a passkey on a work phone or a family tablet, which hands account access to anyone who knows that device's PIN.
- Turning off sync in iCloud Keychain or Google Password Manager, then switching phones and losing every passkey.
- Assuming a passkey protects against everything. It stops password theft, but it will not stop you from installing a malicious app or granting someone remote access to your phone.
- Never reviewing the list. Check your passkeys every few months and delete the ones tied to devices you no longer use.
Frequently Asked Questions
Do I still need my password after creating a passkey?
In most cases the password stays on the account as a fallback, but you will not need to type it for everyday sign-ins on your own devices.
Does my fingerprint get sent to Google or WhatsApp?
No. The biometric only unlocks the key on your device; the service receives a signature.
Can I sign in on someone else's computer?
Yes, by choosing the nearby-device option and scanning the QR code with your phone, without saving anything on that computer.
Do passkeys cost anything?
No. They are built into operating systems and services and do not require a paid app.
Sources
- Google Account Help — Sign in with a passkey instead of a password
- Apple Support — Use passkeys on iPhone and iPad
- Microsoft Support — Signing in with a passkey
- TechRadar — WhatsApp passkey support and setup
- Apple Developer — Passkeys
Because technology is now part of every detail of our day, our interest extends from following Arabic websites and specialized tech blogs to what stores in Egypt, stores in Kuwait, vitamin stores and international websites offer, while relying on Mashhor for social media services as a key factor for success and continuity.
And that is it, dear friends — mission accomplished ✌
Send your blessings upon the beloved Prophet, and do good however small 🎯🌷
And do not forget our brothers and sisters everywhere in your prayers📌
Best regards from the #Raqmiyoun team
You can also browse our store products here 👈#OurStore 🌷or here
To join our family on the Telegram group 👈click here
And our Facebook group, where we share information and help members 👈here
To follow our news on Google News, click here✌👇
Google News
You may also like :
WhatsApp adds a new protective security layer
Social engineering: the hidden danger
Online fraud through ChatGPT results
Phishing With Real Booking Data and Booby-Trapped Calendar Invites: How to Stay Safe
Cisco Firewall Zero-Day CVE-2026-76418 Is Being Exploited: What to Do Now
