Passwords are the weakest link in account security: they get phished, leaked in breaches, and reused across sites. Passkeys fix this at the root. A passkey is a cryptographic key pair where the private key never leaves your device — when you sign in, your iPhone proves you are you with Face ID or Touch ID, and no password ever travels over the network. There is nothing for a phishing site to steal, because there is nothing to type. Google accounts support passkeys on iPhone, and setting one up takes about two minutes.

Before you start, check two prerequisites on your iPhone. First, you need iOS 16 or later — passkeys are built into the system from that version on. Second, iCloud Keychain must be turned on, because that is where the passkey is stored and synced across your Apple devices. Go to Settings, tap your name at the top, then iCloud, and make sure Passwords and Keychain is enabled. If you use multiple Apple devices signed into the same iCloud account, the passkey syncs to all of them automatically, which is also your safety net if you lose one phone.

Now create the passkey. On your iPhone, open Safari or Chrome and go to myaccount.google.com, then sign in with your current password. Tap the menu and choose Security, then find Passkeys under "How you sign in to Google" and tap it. Tap "Create a passkey," then confirm with Face ID or Touch ID when prompted. Google will show a confirmation that the passkey was created and saved to iCloud Keychain. That is the whole process — no authenticator app, no SMS codes, no printing backup codes. If you already use a password manager with family sharing, check whether it also stores passkeys; many now do, giving you a cross-platform backup.

Signing in with a passkey is the satisfying part. On the Google sign-in page, enter your email as usual, and instead of a password prompt you will see an option to use your passkey. Tap it, authenticate with Face ID or Touch ID, and you are in — noticeably faster than typing a password plus a two-factor code. On a computer or a device that does not have your passkey, Google can show a QR code: scan it with your iPhone, approve with biometrics, and the other device signs in. The private key never leaves your phone during this dance, which is why it is safe even on a shared computer.

Do not delete your password just yet. A passkey does not remove your password or your recovery options — keep your recovery phone number and recovery email up to date, because you will need them if you ever lose all your devices. The smart move is redundancy: create a passkey on a second device too, like an iPad or a second phone, so one lost iPhone is an inconvenience rather than a lockout. You can see and remove passkeys anytime under the same Security > Passkeys page in your Google account.

Google is the best place to start, but passkeys are spreading fast: Apple, Microsoft, Amazon, and many banks now support them, and your iPhone stores them all in the same place. For sites that do not offer passkeys yet, keep using a strong unique password plus two-factor authentication — and keep a VPN handy for sensitive logins on public networks, since passkeys protect the login itself but not the connection around it. The direction is clear: passwords are on their way out, and a Google passkey on your iPhone is the easiest first step into that future.