How to Set Up Passkeys on Google, Apple, and Microsoft in 2026: Step-by-Step Guide

Passkeys are now supported by all the major platforms and services: Google (personal and Workspace), Apple ID, Microsoft, GitHub, Amazon, eBay, PayPal, Adobe, Cloudflare, Coinbase, Dropbox, and X among many others. This guide walks through setup on iOS, macOS and Windows, with the official steps from each provider.

Quick answer: to create a passkey, open the sign-in or security settings of the account (Google Account > Security, Apple ID > Sign-In & Security, or Microsoft account > Security), pick "create a passkey", and confirm with your device biometric (Face ID, Touch ID or Windows Hello) or PIN. The private key stays in your device's secure chip, and you then sign in with your fingerprint or face instead of a password. Per-platform steps for iOS, macOS and Windows are below.

01 - What Exactly Is a Passkey?

A passkey is a cryptographic key pair (public + private) generated by your device for each site:

• Private key: never leaves your device. Stored in the secure enclave (Apple Secure Enclave, Google Titan chip, Microsoft TPM). Unlocked by biometrics (Face ID, Touch ID, Windows Hello) or PIN.
• Public key: sent to the site when the passkey is created.

How login works:

1. You click "Sign in"
2. The site sends a cryptographic challenge to your browser
3. Your device requests your biometrics or PIN
4. The private key signs the challenge
5. The site verifies with your registered public key
6. Signed in - no password ever transmitted

Why it's phishing-resistant: the signature is tied to the exact site origin (domain + protocol). A fake site g00gle.com receives a different challenge that google.com can't verify. Unlike TOTP, a passkey cannot be replayed on a fake site.

Software vs hardware passkeys: the passkeys you create on Google, Apple, and Microsoft are software passkeys - stored in the OS key manager and synced to the cloud. Hardware keys like YubiKey store the private key in an inextractable physical chip. For everyday multi-account use, software passkeys are the right choice. See our complete YubiKey FIDO2 guide for high-security profiles.

02 - Google Passkey Setup

Google is the simplest provider to configure. Passkeys sync via Google Password Manager across all your Android devices + Chrome (Windows, macOS).

Steps on Desktop (Chrome)

1. Go to myaccount.google.com
2. Click Security in the left menu
3. Under "How you sign in to Google," click Passkeys and security keys
4. Click Create a passkey
5. Chrome prompts you to confirm - click Continue
6. Authenticate with your computer's biometrics (Windows Hello, Mac Touch ID)
7. ✅ Passkey created and stored in Google Password Manager

Typical time: around 2 minutes from the myaccount.google.com homepage.

Sync to Android

Your Google passkey syncs automatically to all Android devices signed into the same Google account. No additional steps needed. The next Google sign-in on Android will offer the passkey by default.

Sync to iOS/Safari

Google Password Manager doesn't integrate natively with Safari. On iPhone, you have two options:

• Chrome for iOS: Google passkeys work via Chrome (it uses the Google passkey provider)
• Bitwarden: if you store the passkey in Bitwarden instead of Google PM, it'll be available everywhere

Google Troubleshooting

03 - Apple Passkey Setup (iCloud Keychain)

Apple has the smoothest passkey support on its own devices. Passkeys are stored in iCloud Keychain and synced across all your Apple devices via iCloud.

Prerequisites

• iOS 16+ / macOS Ventura (13)+ / iPadOS 16+
• iCloud Keychain enabled: Settings → [your name] → iCloud → Passwords & Keychain (toggle on)
• Two-factor authentication enabled on Apple ID

Steps on iPhone (iOS 17)

On a site that supports passkeys - example: GitHub:

1. Go to github.com in Safari
2. Sign in with your regular password
3. GitHub → Settings → Password and authentication → Passkeys → Add a passkey
4. Safari displays a prompt: "Do you want to save a passkey for github.com using iCloud Keychain?"
5. Tap Continue then authenticate with Face ID
6. ✅ Passkey saved in iCloud Keychain

For Apple sites (Apple ID): Settings → [your name] → Password & Security → Passkeys. Your Apple ID is the first account to secure.

Steps on Mac (macOS Sonoma, Safari)

On Safari for macOS, the flow is identical. Safari automatically offers iCloud Keychain when a site enables passkey enrollment. Note: Chrome on Mac doesn't offer iCloud Keychain by default - it offers Google Password Manager. If you want to store in iCloud Keychain, use Safari on Mac.

iOS AutoFill (Frictionless Sign-In)

Once the passkey is saved, iOS offers biometric AutoFill directly from the native keyboard:

1. You open the app or site
2. A banner appears at the bottom: "Sign in as [account name] ↑"
3. Tap the banner + Face ID
4. Sign-in in <2 seconds

In practice: iOS AutoFill sign-in is among the fastest passkey flows. With iCloud Keychain, passkeys sync automatically across an iPhone and a Mac signed into the same Apple ID, without any reconfiguration.

Apple Troubleshooting

04 - Microsoft Passkey Setup

Microsoft has had solid passkey support since November 2023 with Microsoft Authenticator + Windows Hello. Sync happens via your Microsoft Account.

Via Microsoft Account (Web)

1. Go to account.microsoft.com
2. Click Security in the top menu
3. Then Advanced security options
4. Under "Passkeys (FIDO2)," click Add a new way to sign in
5. Select Passkey
6. Choose where to store: on this device (Windows Hello) or in Microsoft Authenticator (mobile app)

Via Windows Hello (Windows 11)

Windows Hello stores passkeys locally in your PC's TPM:

1. Windows Settings → Accounts → Sign-in options → Windows Hello Face/Fingerprint
2. On your next sign-in to account.microsoft.com via Edge, Windows automatically offers to create a Windows Hello passkey
3. Confirm with Face or fingerprint Windows Hello
4. This passkey is tied to this device only - no cross-device sync for local Windows Hello passkeys

Via Microsoft Authenticator (iOS/Android)

Microsoft Authenticator can act as a cross-platform passkey provider:

1. Install Microsoft Authenticator (iOS App Store / Google Play)
2. Sign in with your Microsoft Account in the app
3. On account.microsoft.com → Security → Advanced options → Add passkey
4. Select Another device or Security key
5. A QR code appears - scan it with Microsoft Authenticator
6. Authenticator generates the passkey (synced via your Microsoft Account)

Typical time: about 3 minutes including Authenticator install; under 90 seconds if it's already installed.

Microsoft Services Supporting Passkeys in 2026

• Microsoft Account (Outlook.com, Hotmail)
• Xbox
• Microsoft 365 (with Azure AD/Entra ID configured by admin)
• Teams (personal)
• Outlook.com

Azure AD / Entra ID: in enterprise environments, configuration is done by the admin (Entra ID portal), not the end user. Check with your IT team.

Microsoft Troubleshooting

05 - Cross-Provider and Limitations in 2026

This is the most confusing topic. As of June 2026, here's the exact state of affairs:

What Works

Cross-Ecosystem Bridges

The CTAP2.2 cross-device passkey sharing standard (Apple-Google-Microsoft) is being finalized in 2026. The promise: a passkey created in iCloud Keychain could be exported to Google Password Manager. In practice, June 2026: this interoperability is not yet natively deployed across the 3 providers.

Pragmatic solution: use Bitwarden as a unified passkey provider. When creating a passkey, instead of letting the browser choose iCloud or Google PM, you select Bitwarden as the provider. The passkey then lives in your vault, synced across all OS. This is the most practical approach for managing many passkeys across platforms - see Bitwarden vs 1Password 2026.

06 - Backup and Recovery

Golden Rule: Never Rely on a Single Device

Loss scenarios:

1. You lose your iPhone → Your Apple passkeys are in iCloud Keychain → they automatically restore on your new iPhone when you sign into your Apple ID. Recovery time: 15 min.
2. You lose your Android → Google PM passkeys restore via Google Account on new phone. Time: 10 min.
3. You lose your Windows PC → Windows Hello passkeys are gone (local). Microsoft Authenticator passkeys survive (cloud sync). You'll need to recreate Windows Hello passkeys on the new PC.

Recovery Procedure

For each account where you have a passkey:

1. Go to the account's security settings
2. Sign in with password + 2FA (fallback always active)
3. Delete the passkey from the lost device
4. Create a new passkey on your new device

Time per account: 3-5 min. For 10 accounts: expect 30-45 min.

Security Backup Tips

• ✅ Keep your password in Bitwarden for every account with a passkey - it's your real safety net
• ✅ TOTP 2FA on critical accounts (Bitwarden Authenticator or Aegis) - second fallback
• ✅ Recovery codes: download and store the one-time codes most services generate during 2FA setup (Google, GitHub, etc.)
• ✅ Bitwarden export: make a monthly encrypted export of your vault (Tools → Export)
• ❌ Never disable your password on critical accounts until passkeys are 100% mature

For details on 2FA backup apps, see our best authenticator app 2FA 2026 comparison.

07 - Which Provider to Choose for Your Ecosystem

A typical cross-platform setup: in a mixed iPhone + Mac + Windows environment, iCloud Keychain works well for Apple-first accounts, but a cross-platform manager like Bitwarden is more practical for accounts you use everywhere. The concrete advantage: you can sign into a service such as GitHub from any OS without friction, using the same passkey managed by Bitwarden.

For new users starting from scratch: begin with Google Passkeys on your Google accounts (the fastest setup, <2 min), then evaluate whether you need cross-platform before investing in Bitwarden Premium.

If you want to understand why passkeys outperform traditional passwords technically, the passkeys vs passwords 2026 article covers the comparison in detail.

To choose the password manager that also handles your passkeys, our best password managers 2026 comparison does a complete tour.

Based on the documented passkey setup flows on iOS 17.5, macOS Sonoma 14.5 and Windows 11 23H2. Times are indicative, June 2026.