A passkey replaces your password with a pair of cryptographic keys. One half stays locked on your phone, laptop or security key; the other half sits with the website. You sign in with your fingerprint, face or device PIN, and nothing that could be stolen and reused ever crosses the internet.
That sounds like marketing until you look at what it removes: there is no password to guess, no password to reuse across sites, and nothing for a fake login page to capture. Passkeys are the first authentication change in decades that makes phishing structurally impossible rather than just harder.
How a passkey actually works
- When you create one, your device generates a key pair for that site and stores the private key in its secure hardware.
- The site keeps only the public key, which is useless on its own — a breach of the site exposes nothing worth stealing.
- To sign in, the site sends a random challenge. Your device asks for your fingerprint, face or PIN, signs the challenge, and sends the signature back.
- The signature proves you hold the private key without revealing it.
The critical detail is that a passkey is bound to the exact web domain it was created for. A convincing copy of your bank’s login page at a slightly different address cannot ask your device for that passkey, because the domain does not match. Your biometric data never leaves the device either — it only unlocks the key locally.
Synced or device-bound
Most passkeys sync. Apple’s are end-to-end encrypted through iCloud Keychain, Google’s sync through Google Password Manager across Android, Windows, macOS and ChromeOS, and password managers such as Bitwarden, 1Password, NordPass and Proton Pass store them too. That means losing a phone does not lock you out.
Device-bound passkeys live on a hardware security key and never leave it. They are the stronger option for high-risk accounts, at the cost of needing a backup key in case the first is lost.
Where you can use passkeys in New Zealand
| Service | Passkey support |
|---|---|
| Inland Revenue (myIR) | Yes — set up under Manage my profile, Security |
| Trade Me | Yes, as a multi-factor option |
| Air New Zealand | Yes, rolled out to customers in 2025 |
| Google, Microsoft, Apple accounts | Yes |
| NZ banks | Not for web login as at September 2026 — they use app approval, SMS codes or in-app biometrics |
Internationally the FIDO Alliance counted roughly five billion passkeys in use by May 2026, and Microsoft reports sign-in success rates far above passwords. The New Zealand rollout is slower but moving, and the government’s myIR support is the one most people will meet first.
What passkeys do not fix
You will keep passwords for years. Most sites still do not offer passkeys, and many that do use them as an extra option rather than a replacement, leaving the old password as a fallback an attacker can still target. Where that fallback exists, a long unique password and two-factor authentication still matter — the password manager guide and our breach checking guide cover that side.
Account recovery is the other weak point. If a site lets you reset access with an email link or an SMS code, that route is only as strong as your email account, which is why email deserves your strongest protection of all.
Getting started
Add a passkey to one account you use often — a Google or Microsoft account is the easiest test — and sign in with it a few times before converting anything important. Keep a second method registered until you are confident. If you use a password manager, create passkeys inside it rather than in a single device’s keychain, so they follow you across platforms; our Bitwarden review covers one free option that stores them.
Disclaimer
General information only. If you lose access to an account, use the provider’s own recovery process; for suspected fraud in New Zealand, contact your bank and report it to the NCSC on 0800 114 115.
Reference sources
Frequently asked questions
What is a passkey in simple terms?
A login that uses a key stored on your device and unlocked by your fingerprint, face or PIN, instead of a password you type. The site never receives anything an attacker could reuse.
Are passkeys safer than passwords?
Yes, for two structural reasons: there is no shared secret to steal in a breach, and a passkey only works on the real website’s domain, so phishing pages cannot use it.
What happens if I lose my phone?
Synced passkeys are restored when you sign in to your Apple, Google or password manager account on a new device. Device-bound passkeys on a hardware key are gone with the key, which is why you register a backup.
Does a passkey store my fingerprint?
No. The biometric stays on your device and only unlocks the private key locally. Websites never receive it.
Can I use passkeys with my New Zealand bank?
Not for web login as at September 2026. NZ banks use app approval, in-app biometrics or SMS codes. Inland Revenue’s myIR and Trade Me do support passkeys.
Do I still need a password manager?
Yes. Most sites still use passwords, and a manager now stores passkeys alongside them, which keeps both in one place that works across your devices.
