iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To enable passkey access, the app or website must offer passkeys in its own sign-in or security settings. Choose Create, Continue, or a similarly named passkey option, select where to save it (Windows Hello, a synced credential manager, a phone or tablet, or a FIDO2 security key), and complete that destination’s unlock prompt.
For a passkey saved directly on your PC, open Settings > Accounts > Passkeys to review or delete it. The exact choices vary by service, browser, Windows build, account type, and whether an administrator controls the device.
What a Windows 11 passkey does
A passkey replaces a memorized password with a cryptographic credential. When you register one, the service keeps a public key while the private key remains on your Windows device or with the credential provider you selected. During sign-in, Windows or that provider unlocks the private key after you verify locally with a PIN, fingerprint, face recognition, a phone gesture, or a security-key touch. The service never receives your biometric data or your Windows Hello PIN.
The credential is tied to the app’s or website’s domain. A passkey created for one domain is therefore not offered to a lookalike domain, which helps block phishing. This protection does not make every app passkey-capable: the service must implement passkey registration and sign-in first.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Passkeys can be device-bound or synced. A device-bound passkey is usable on the Windows PC where it was created and does not automatically follow you to a replacement computer. A synced passkey is provided by a credential manager on supported devices, so losing one device does not necessarily remove access. Choose deliberately rather than accepting an unfamiliar storage location.
Check these requirements before you start
- Service support: Open the app’s account, security, or sign-in page and look for passkey wording. If no create, add, or use-passkey control appears, Windows cannot add one through that service.
- A compatible browser: Microsoft lists Edge 109 or newer, Chrome 109 or newer, and Safari 16 or newer among supported browsers in its passkey guidance. Availability can still depend on the service and operating-system build. See Microsoft’s passkey compatibility guidance.
- A local unlock method: Windows Hello can use a PIN. Fingerprint sign-in requires a compatible fingerprint reader, and face sign-in requires a compatible camera.
- Screen lock for synced credentials: A phone or computer generally needs an active PIN, fingerprint, face unlock, or another screen lock before a credential manager will release a passkey.
- Permission for managed accounts: A work or school administrator may disable passkeys or limit the destinations you can choose.
If you intend to use Microsoft Password Manager, Microsoft’s current rollout notes require Edge version 142 or newer and a personal Edge profile. That narrower requirement is separate from the general browser versions listed above.
Enable a passkey from an app or website
- Open the service’s security settings. Sign in normally, then look under Account, Security, Sign-in methods, or a similar area. Some services offer passkey creation immediately after a successful password sign-in; others place it behind an Add passkey button.
- Start registration. Select Create passkey, Add a passkey, or the equivalent. If a prompt says Create a passkey to sign in?, choose Continue or Create to accept the suggested destination.
- Change the destination if needed. Choose Change or Save another way when those controls appear. The list can include this Windows device through Windows Hello, a synced password manager, a nearby phone or tablet, or a physical security key. Not every service displays every option.
- Approve the destination’s instructions. For Windows Hello, select the account or profile if prompted and enter your Windows Hello PIN, fingerprint, or face verification. A phone flow may show a QR code; scan it with the phone’s camera and approve the request on the phone.
- Wait for confirmation. The service should report that the passkey was added and may display its name, creation date, or device. If it asks you to name the credential, use a label that identifies the device or manager without putting sensitive information in the name.
- Test before ending the session. Sign out in a separate browser tab or private window and choose Sign in with a passkey. Confirm that the expected Windows, phone, manager, or security-key prompt appears before relying on the passkey as your only method.
Microsoft documents the registration choices and the separate personal-account and work-account flows in its passkey creation instructions. Some Edge configurations can offer to create a passkey automatically after a compatible sign-in; you can still choose another save location when the dialog provides that option.
Recommended Free Tools
Set up Windows Hello for local passkeys
Windows Hello is the local authentication layer, not a separate online account. Configure it before registering a passkey if Hello is not already active.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Open Settings > Accounts > Sign-in options.
- Under the Windows Hello section, select PIN (Windows Hello) and choose Set up or Change. Complete the identity check and create a PIN.
- Optionally configure Fingerprint recognition (Windows Hello) or Facial recognition (Windows Hello). Follow the enrollment wizard and confirm that your reader or camera is compatible.
- Return to the app or website and repeat the passkey-registration steps. When Windows asks how to unlock the credential, use the Hello method you configured.
A PIN is sufficient for passkey use; biometric hardware is optional. Keep the PIN private and do not treat it as the online account password. Microsoft’s hardware and settings details are in Configure Windows Hello.
Choose where the passkey is stored
The save-location prompt is the most important decision in setup. Compare the options before selecting Continue.
| Storage choice | Where the private key lives | Sync and device access | Unlock method and considerations |
|---|---|---|---|
| Windows Hello, device-bound | Locally on the Windows 11 device | Does not sync automatically; normally usable only on that device | Windows Hello PIN, fingerprint, or face. Convenient on a personal PC, but create another recovery route before the PC is lost, reset, or replaced. |
| Synced credential manager | With the manager’s protected credential store | Available on other supported devices signed in to the same manager | Usually requires a device screen lock. Microsoft names Microsoft Password Manager, Google Password Manager, and Apple iCloud Keychain as examples; availability depends on browser, operating system, and account. |
| Phone or tablet | On the selected mobile device | Useful when the PC should not retain the credential; access follows the phone or tablet | Often uses a QR-code handoff. Bluetooth, nearby-device permission, internet access, and an unlock gesture may be required. |
| FIDO2 security key | Inside the physical key | Portable between compatible computers; no cloud sync | Insert USB or use NFC, then touch or enter the key’s PIN as requested. It is an optional purchase, not a prerequisite for Windows Hello. |
For a household or shared computer, a synced manager or phone can avoid leaving a personal credential on the machine. For a frequently used personal laptop, Windows Hello is usually the quickest choice. Whichever option you select, keep at least one additional sign-in or account-recovery method until you have verified the passkey on every device you need.
Microsoft account and organization-specific enrollment
Personal Microsoft account
For a personal Microsoft account, open the account’s Advanced security options, choose to add a new sign-in method, and select passkey. The browser then presents the same destination choices described above. A passkey saved to Windows Hello is tied to that PC; one saved through a supported manager follows that manager’s sync rules. Microsoft-account passkeys can also be reviewed from the account security dashboard in addition to local Windows settings.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Work or school account
For an organization account, open Security info and select Add sign-in method, then choose passkey if the tenant allows it. Administrators can require particular authenticators, block personal credential managers, or limit registration to company-managed devices. If Passkey is absent from Security info, contact the organization’s administrator rather than changing Windows settings repeatedly.
Sign in with the passkey later
- Open the app or website’s sign-in page and enter your username if requested.
- Select Sign in with a passkey, Use passkey, or the passkey icon. Some services put this under Other ways to sign in.
- Choose the listed Windows device, credential manager, phone, or security key. If Windows offers several credentials, select the one whose account and domain match the service.
- Complete the local prompt: enter the Windows Hello PIN, use a biometric, approve the phone request, or connect and touch the security key.
- Allow the service a moment to verify the public-key response. A successful result returns you to the signed-in app without asking for the account password.
Never approve a passkey prompt you did not initiate. Unexpected prompts can indicate that another person is attempting to sign in, even though the cryptographic check prevents a credential from being used on a different domain.
View or remove passkeys in Windows 11
Windows exposes passkeys stored locally on the computer at Settings > Accounts > Passkeys. Select a listed credential to view its associated account or remove it. Deleting a local entry does not necessarily remove a copy held by a synced manager, phone, security key, or the online service.
Free tools Windows power users keep installed
One-click scans. No signup required.
Before removing the last passkey, confirm that you can sign in with another passkey, a password, an authenticator, or the service’s recovery process. For synced credentials, use the credential manager’s own account and device controls. For a Microsoft account, also check the account security dashboard so an obsolete credential is not left active online.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft’s local-management steps are documented at Manage your saved passkeys.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Fix missing passkey choices
The app never offers passkeys
Check the service’s help or security page and try its latest browser version. If the sign-in flow has no passkey registration or sign-in control, the service has not enabled the feature for your account, region, or account type. Windows cannot add a passkey on the service’s behalf.
Windows Hello is not listed
Install pending Windows updates, verify that a Windows Hello PIN exists under Settings > Accounts > Sign-in options, and retry in a supported browser. A work or school policy may hide Windows Hello or prevent device-bound credentials. If the browser is managed, ask the administrator whether passkeys are allowed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A synced passkey does not appear
Sign in to the correct credential-manager account and make sure the current device has a screen lock. Managers may not expose passkeys until a PIN, fingerprint, or face unlock is enabled. Confirm that your browser and operating-system versions meet the manager’s requirements; Microsoft Password Manager, for example, currently requires Edge 142 or newer with a personal profile.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
QR-code sign-in times out
- Turn on Bluetooth on both the Windows PC and the phone or tablet.
- Keep the devices close together and allow nearby-device permissions.
- Verify that both devices have internet connectivity.
- Unlock the phone before scanning and complete its approval promptly.
- Restart the QR flow if either device sat idle long enough to time out.
These checks reflect Microsoft’s guidance in Troubleshoot signing in with a passkey.
The passkey disappeared after replacing a PC
A Windows Hello passkey created on the old computer is device-bound and will not migrate automatically. Use the old computer, if available, to sign in and register a new passkey on the replacement device or in a synced manager. Test the new credential, then remove the obsolete one from the service and the old computer where appropriate. If the old device is unavailable, use another registered sign-in method or the service’s account-recovery process.
Use a physical security key instead
A FIDO2 security key is useful when you want a portable credential that is independent of Windows Hello and cloud synchronization. During registration, choose Security key or Save another way, connect the USB key or bring an NFC key near the reader, create or enter the key’s PIN if requested, and touch the key when its indicator prompts you. At sign-in, repeat the USB or NFC step.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe key is an additional option, not a requirement for passkeys on Windows 11. It can be particularly useful for administrators, travelers, or anyone who needs the same authenticator on several computers. Follow Microsoft’s account setup instructions at Sign in to your account with a security key.
Security and recovery practices
- Register a second passkey on another device or in a trusted synced manager before deleting a password or replacing hardware.
- Keep the Windows Hello PIN, phone screen lock, and security-key PIN private; they unlock the credential locally.
- Review the service’s registered passkeys periodically and remove devices you no longer own.
- Use the exact account and domain shown in the sign-in prompt. A passkey will not authenticate a different domain, but entering credentials into a lookalike site can still expose them.
- For work or school accounts, follow the organization’s required recovery and device policies; an administrator may be able to revoke credentials centrally.
With those safeguards, passkey access gives a Windows 11 app a passwordless sign-in path while preserving a practical fallback if a device, browser, or credential provider becomes unavailable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
