How to set up passkeys on Android and why they beat passwords
A passkey lets you sign in with your fingerprint or screen lock instead of a password. Learn how to create one for your Google account on Android.
A passkey replaces a password with a secret stored on your phone and unlocked by your fingerprint, face or screen lock. It cannot be typed into a fake website, so it blocks a common trick. Many sites now support it. Menu names differ slightly on Samsung, Xiaomi, Vivo, Oppo, Realme and OnePlus phones.
Steps
- Check your phone is ready. You need a screen lock set up, a recent Android version and a Google account signed in. Passkeys work best on Android 9 or later. Make sure your phone is updated.
- Open the Passkeys page. Open your Google account from Settings, then Manage your Google Account, then Security. Look for Passkeys and security keys. You may be asked to verify yourself with your lock.
- Create a passkey. Tap Create a passkey and follow the prompt. Your phone will ask for your fingerprint, face or PIN. After that, the passkey is saved to your Google Password Manager on the phone.
- Try it. Next time you sign in to Google on a new device, choose the passkey option. You will be asked to confirm with your screen lock instead of typing a password. Test it while you still know your password.
- Add passkeys to other sites. On sites that offer it, look in account security settings for Create passkey. Your phone will offer to save one. Keep a backup sign-in method and a strong screen lock, because the passkey depends on it.
Menu names differ a little between phone makers and Android versions. If you cannot find a setting, open Settings and use the search box.
Why it matters
Most phishing works by getting you to type your password on a fake page. A passkey is tied to the real site, so it simply will not work on a lookalike. It also cannot be guessed or leaked in a data breach. It is not magic, but it removes a big weak point.
Watch out for
- If someone knows your screen lock, they may be able to use your passkeys.
- Do not delete a passkey before you have another way to sign in.
- A shared phone can mean shared passkeys, so keep your own profile.
- Passkeys do not protect you from being told to approve a fake payment.
How Safeavio helps
Safeavio's link check helps you look at a sign-in link before you open it, and its password-exposure check shows only the date and a rough result for a password. Phone scan warns when the phone has no screen lock. It does not create or store your passkeys.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
Questions
What if I lose the phone with my passkeys?
Passkeys can sync with your Google account, so you can recover them on a new phone after signing in. Keep recovery options updated and use another strong sign-in as backup.
Do passkeys replace 2-step verification?
A passkey is itself a strong sign-in that combines something you have and something you are or know. Keep 2-Step Verification on as a backup and for sites without passkeys.