A passkey lets you approve a sign-in using a credential stored by your device or passkey provider, often after unlocking it with a fingerprint, face check or PIN. The website receives cryptographic proof that the credential was used. It does not need a reusable password that you type into a page.

That changes an important part of account security, but it also creates practical questions: where is the passkey stored, will it be available on a replacement phone, and how can the account be recovered if every copy is lost? Those questions deserve attention when you set up the credential, rather than only after a device disappears.

For readers in India there is a second question: does a passkey replace the OTP your bank sends? For signing in to an app or website, it can, if the service offers one. For a payment, the answer depends on your bank, because almost every digital payment in India must still pass the Reserve Bank of India’s two-factor test, which since 1 April 2026 no longer assumes the second factor is an SMS OTP. The India section below explains what that means.

The website verifies a cryptographic response

The FIDO Alliance describes passkeys as credentials built on public-key cryptography. Registration associates a public key with the account. During sign-in, the credential produces a response that the service can verify using that public key. The private-key side is managed by the authenticator or passkey provider.

The credential is tied to the relevant website or application. That binding is central to phishing resistance: a convincing copy of a sign-in page on an unrelated domain cannot simply ask the browser for the real site’s credential. There is no ordinary password string for the user to copy from a genuine service into the lookalike page.

Diagram showing a website sending a sign-in challenge, local approval on a device, and a signed response verified by the website.

Simplified passkey sign-in, based on FIDO and Passkey Central explanations. Local user verification and the website’s verification of the cryptographic response are different steps.

This protection applies to authentication. It does not make every action after signing in safe, prevent a user from sharing sensitive information with a deceptive service, or cure a compromised session. A secure credential is one component of an account system, alongside device security, recovery and the service’s own controls.

Your face or fingerprint stays on the device

Biometric unlock is a local way to approve use of a credential. FIDO’s explanation states that biometric processing remains on the device; the remote service receives assurance about the verification, not the fingerprint or face image. A device PIN or other supported local method can play the same approval role.

For a user, this means changing the sign-in method does not require assuming that every website now stores a copy of their face. It also means the screen-lock method matters. Someone who can unlock a device may be able to use credentials available on it, depending on the provider and configuration.

Keep shared-device situations in mind. A personal passkey stored in a shared computer’s provider may remain available beyond the intended session. Google’s passkey support page specifically advises removing a passkey created on a shared device by mistake. Signing out of a webpage and removing a credential are different actions.

Synced and device-bound passkeys recover differently

Passkey Central distinguishes credentials that can be synchronised through a provider from credentials tied to a particular authenticator. A synced passkey may become available on another device signed into the same provider, subject to that provider’s security and recovery process.

A device-bound passkey remains on its device or hardware security key. That can be useful when control of a particular authenticator is required, but losing the only registered copy creates a different recovery problem. A spare registered authenticator can help only if it was set up and remains accessible.

Question Synced passkey Device-bound passkey
Where can it be used? Across supported devices through its provider Through the particular device or security key
What needs protection? Devices and the provider account The authenticator and its local access controls
What happens after loss? Recovery may restore access through the provider Another registered method or account recovery may be needed

The table describes general categories, not a guarantee that every provider behaves identically. Cross-device sign-in and moving a credential into another provider are also different operations. Being able to approve a sign-in with your phone does not necessarily mean that the website has stored a new passkey on the computer you are using.

Check the recovery path while access still works

Open the account’s security settings and identify the registered sign-in methods. Record which device, provider or security key each passkey belongs to, using a meaningful label if the service supports one. Check whether a second trusted device or authenticator can sign in before relying on it as a backup.

Recovery arrangements are service-specific. Google’s guidance for lost devices and verification methods lists possible routes such as another signed-in device, a registered security key or a passkey on another device. When those are unavailable, its account recovery process may be necessary. These options depend on what was configured and should not be assumed to exist on every account.

Adding a passkey does not automatically remove older sign-in methods. Google explicitly notes that creating one does not remove the account’s existing authentication or recovery factors. Review those methods as part of the same task: an outdated recovery address can remain relevant even when day-to-day sign-in uses a stronger credential.

A lost phone calls for an account review

Use a trusted device that you can still access to review the affected accounts. Follow each provider’s instructions for removing the lost device’s passkey and revoking its sessions. Google’s support guidance treats removal of the lost credential as a specific action; it should not be confused with simply creating a replacement.

If you no longer have another route in, use the service’s official account recovery process. Avoid assuming that a stranger offering a rapid recovery service has special access. The useful preparation is a known recovery route and protected backup methods, checked before the loss happens.

For work accounts, organisational policy may determine which providers and authenticators are permitted. The same attention to access is valuable when connecting financial services or receiving digital assets: our stablecoin redemption guide explains why a balance and the ability to use it depend on several separate systems.

Passkeys, OTPs and payments in India

The RBI’s “Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025”, dated 25 September 2025, set the rules every bank and payment company had to follow from 1 April 2026. The directions note that the RBI never mandated a particular factor, but that the payments ecosystem had “primarily adopted SMS-based One Time Password (OTP)” as the additional one. They now require three things of a digital payment, unless it falls in an exempt category:

  • at least two distinct factors of authentication;
  • for anything other than a card-present transaction, at least one factor that is “dynamically created or proven”, meaning the proof sent with the payment is unique to that payment; and
  • factors chosen so that compromising one “does not affect reliability of the other”.

The directions do not use the word passkey. They define factors by category and list examples, and they let issuers “offer a choice of authentication factors” to customers. The table sets the RBI’s categories beside the parts of a passkey sign-in described earlier; the third column is our reading, not the RBI’s.

RBI factor category Examples named in the directions Where a passkey’s parts fit
Something the user has Card hardware, software token The device or security key holding the private key
Something the user knows Password, passphrase, PIN A device PIN used to unlock the passkey
Something the user is Fingerprint, “any other form of biometrics (device native or Aadhaar based)” A fingerprint or face check used to unlock the passkey

A passkey signs a fresh challenge each time it is used, which is the kind of transaction-unique proof the dynamic-factor rule describes. Whether a given bank treats a passkey, a device biometric or an in-app approval as meeting the two-factor rule for payments is the bank’s decision, so check what your bank’s app offers rather than assuming the OTP has gone.

Two other parts of the directions matter to customers. Issuers may add checks beyond two factors for transactions their risk systems flag, judged on things such as location, device and transaction history, and the RBI suggests they could use DigiLocker to notify and confirm high-risk transactions. And if a loss arises from a transaction carried out without complying with the directions, the issuer “shall compensate the customer for the loss in full without demur”. That sits alongside the older RBI rules on liability for unauthorised electronic transactions, which also turn on how quickly you report the debit.

The SMS OTP itself has a known weak point that a passkey does not share: whoever controls the SIM receives it. Our guide to SIM swap fraud explains how a number takeover can let a fraudster receive SMS one-time passwords, and what to do when your phone suddenly shows no service.

Questions

Is a passkey the same as a fingerprint?

No. The passkey is a cryptographic credential. A fingerprint, face check or PIN can be used locally to approve its use.

Can I use a passkey after replacing my phone?

Possibly, depending on whether it is synced and whether you can access the relevant provider. A device-bound credential has a different recovery path.

Does adding a passkey delete my password?

Not necessarily. Services handle existing sign-in and recovery methods differently. Check the account’s security settings and documentation.

Passkey vs OTP: which is safer?

The FIDO Alliance, which publishes the passkey standards, says common second factors such as one-time passwords “are both inconvenient and still phishable”, and that a passkey on its own is more secure than a password plus an OTP. The reason is the site binding described above: an OTP can be read out or typed into a fake page, while a passkey only answers the real site. Banks in India still decide which factors they accept for payments.

Can I use a passkey for online banking in India?

Only where your bank offers one. The RBI’s 2025 directions allow banks to offer a choice of factors, including device-native biometrics, but they do not require passkeys. Look in your bank’s app or internet-banking security settings, and treat any unsolicited link offering to “set up a passkey” for your bank as suspect.

Has the RBI stopped OTPs?

No. SMS OTP is still listed as a factor of authentication. What the 2025 directions changed, from 1 April 2026, is the framework around it: other factors that pass the two-factor and dynamic-factor tests are expressly allowed, and the issuer bears the full loss when a non-compliant check lets a payment through.

Are passkeys immune to every account attack?

No. They provide phishing-resistant authentication, while device compromise, session theft, recovery and deceptive requests still require separate controls.

Sources

Sources first reviewed 26 September 2026; all links rechecked and the India section added on 5 November 2026. Explore Tech & Security, or contact Journalist Today.