A fingerprint unlocks the credential; it is not the credential
A passkey lets you sign in using a credential protected by your phone, computer or security key. You normally approve its use with the same kind of device unlock you already recognise: a fingerprint, face scan or PIN. FIDO Alliance explains that the underlying credential is a cryptographic key pair. The service stores a public key; the authenticator uses the private key to answer a sign-in challenge. Your fingerprint is not being turned into a password that the website receives.
Why a convincing fake login page has a harder job
FIDO credentials are tied to the service’s domain. A copied website can imitate the logo and wording of a sign-in form, but that appearance does not give it the legitimate site’s identity for passkey authentication. With a password, a person can type the same secret into the wrong form; passkeys remove that reusable-secret step from the sign-in flow. This protection concerns authentication. It does not establish that every message, download or payment request encountered after signing in is trustworthy.
Does the website receive your fingerprint or face scan?
FIDO says biometric information and processing remain on the device; the server receives assurance that the local check succeeded. A device PIN can also authorise use of the credential. That makes two questions worth separating: how your device confirms it is you, and how the website verifies the credential. “Sign in with your fingerprint” describes the first experience, while the cryptographic exchange explains the second.
Synced and device-bound passkeys behave differently
FIDO distinguishes passkeys that can sync through a credential provider from passkeys bound to a particular device, including hardware security keys. Consequently, “my passkey is on my phone” is not enough information to determine whether it will be available elsewhere. Check where the credential is stored, whether syncing is enabled and which recovery methods the account supports. Do that while you still have access rather than assume that every service offers the same recovery process.
What happens if your phone is lost?
For a Google Account, Google documents an alternative sign-in route through Try another way and tells users to remove a passkey associated with a lost or stolen device from an account they can access. Google also says creating a passkey does not automatically remove the option to sign in with a password. These are Google-specific instructions, not a universal recovery guarantee. A useful preparation is to review your own account’s alternative sign-in methods before changing phones or removing a working credential.
Why shared devices require care
Google warns against creating passkeys on shared devices: someone who can unlock the device may be able to use its passkey to access your account. Signing out of a website and removing a stored credential are different actions. When reviewing a setup, ask three concrete questions: whose device is this, who can unlock it, and how would I recover access without it? The answers matter more than assuming that the word passwordless means access management no longer matters. This is a general information guide, not a claim that we tested every provider.