Use Passkeys in Windows 11: Create, Sign In, and Manage

Passkeys let you sign in to a website or app without typing that service’s password. On Windows 11, a passkey can be protected by Windows Hello, such as your PIN, face, or fingerprint. The website or app must support passkeys, and that service starts the process of creating one.

Windows Settings is where you can review passkeys saved on the PC and choose passkey-provider options. It is not a universal place to create a passkey for every website.

How to create and use a passkey in Windows 11

1. Set up a Windows Hello sign-in method

1. Open Settings.
2. Select Accounts, then Sign-in options.
3. Set up or confirm the PIN, fingerprint, or facial-recognition method offered by the PC. If you have not enrolled a finger yet, see how to add a fingerprint in Windows 11.

Windows uses this local verification step to protect a passkey saved with Windows Hello. Keep the device PIN private; it is different from the password for an online account. If you forget the PIN or the account password, see how to reset a Windows 11 password or PIN.

2. Start passkey registration at the website or app

1. Go to a website or app that says it supports passkeys.
2. Sign in with the account’s current method if the service requires it.
3. Open the account’s security or sign-in settings and choose its option to create, add, or save a passkey.
4. When Windows asks where to save the passkey, choose the option that fits the device and credential provider you use.
5. Confirm the request with Windows Hello when prompted.

Microsoft explains that a service registers a public key while the related private key is protected by the passkey provider. This design makes a passkey specific to the service where it was created.

3. Choose where the passkey is saved

A passkey may be saved to the Windows device, to a supported synchronized credential manager, or to another supported authenticator. The choices shown depend on the website, browser, device, and providers configured on the PC.

A device-bound passkey remains on its device. A synchronized passkey is managed by its credential provider and may become available on another device after that provider verifies you. Check the provider’s own recovery information before relying on a particular option.

4. Sign in with the passkey

1. Open the same supported website or app.
2. Select its passkey sign-in option, or choose Sign-in options if that is how the service presents it.
3. Select Windows Hello, a security key, a phone, or another option that the service offers.
4. Verify the sign-in request with the selected device or provider.

Windows may show a security prompt for your face, fingerprint, or PIN. Confirm only when the website address and sign-in request match the service you intended to use.

Manage passkeys saved on the Windows device

1. Open Settings.
2. Select Accounts → Passkeys.
3. Review the entries saved locally on the device.
4. Select Delete passkey beside an entry only when you no longer want that local passkey.

For storage choices and supported providers, open Accounts → Passkeys → Advanced options. An organization can limit these settings on a work or school device. Passkeys stored by a provider may also need to be managed through that provider or through the service account’s security page.

What to do if a device is lost or replaced

First, use the recovery process offered by the affected website or app. Then check the documentation for the credential provider that stored the passkey. A device-bound passkey and a synchronized passkey have different recovery paths, so do not assume that signing in on a new PC will restore every passkey automatically.

For a work or school account, contact the organization’s IT administrator if its sign-in policy or recovery process applies.

If a passkey won’t work

• Windows doesn’t offer to save a passkey. The site may not support passkeys yet, or your browser needs an update. Check the site’s security settings for a passkey option.
• Windows Hello isn’t set up. Go to Settings > Accounts > Sign-in options and add a PIN first. Passkeys on Windows need Windows Hello.
• Sign-in asks for a phone or security key instead. The passkey may be saved on another device. Choose the option to use a phone or tablet and scan the QR code, or sign in another way and create a passkey on this PC.
• The passkey stopped working after a PC reset. Passkeys saved only on that PC are deleted by a reset. Sign in with the site’s recovery option and create a new one.

Passkey questions

Are passkeys safer than passwords?

Passkeys use public-key cryptography and are designed to be phishing-resistant. They are unique to the site or app where they are registered, but you should still verify the website and approve only expected sign-in prompts.

Can every site use a passkey?

No. The website or app must support passkeys and present a registration or sign-in option.

Can I delete a passkey from Windows?

Yes. Windows Settings can remove a passkey saved locally on the PC. If the service or a synchronized provider also lists the passkey, review those locations as well before considering it fully removed.

Summary

1. Set up Windows Hello.
2. Create a passkey from a site or app that supports it.
3. Choose an appropriate save location when prompted.
4. Use the passkey sign-in option and verify the request.
5. Manage local entries in Settings → Accounts → Passkeys.

For Microsoft’s current instructions, see Create and save a passkey and Manage your saved passkeys.

Related: How to set a PIN in Windows 11.

Related: How to find stored passwords on Windows 11.

Related: set a password on a Windows 11 HP laptop.

Related: how to remove your PIN in Windows 11.