A passkey replaces the password with something your device proves on your behalf. Instead of typing a secret that can be guessed, reused or handed to a fake page, you unlock your phone or laptop the way you already do - face, fingerprint or PIN - and it quietly confirms to the website that it is really you. There is no password to remember and, crucially, none to be stolen in a breach.

The reason this matters is that it removes the mechanism most scams rely on. A phishing page works by persuading you to type your password somewhere it can be captured. A passkey cannot be typed into the wrong place, because it is tied to the genuine website and never leaves your device in a form anyone can reuse. It defeats phishing not by teaching you to spot it, but by making the thing they are fishing for impossible to give away.

You can use passkeys today on more services than most people realise. The large accounts - Google, Microsoft, Apple, and a growing number of banks and shops - already offer them, usually under a security or sign-in setting labelled “passkey” or “sign in without a password”. Set one up and your phone or laptop stores it, then offers it automatically next time. Most people are pleasantly surprised at how little there is to it.

It is an easing-out rather than a switch-off, so expect passwords to linger for a while yet. Not every service supports passkeys, and you will keep a password on the ones that do not. It is sensible to set a passkey where you can while keeping your existing sign-in as a backup, and to make sure you can still get in if you lose the device - through a second device or a recovery method you have tested.

Start with the accounts that matter most: your email first, because it is the key that resets everything else, then your bank and your main shopping accounts. Turning those into passkeys removes the single most attacked step in the whole chain, and you can do it in a quiet ten minutes rather than all at once.