Windows 11 can use a passkey for an app or website only when that service supports passkeys in its own sign-in or security settings. When the option appears, choose Create passkey, Continue, or a similar command, select where to save it, and approve the Windows Hello, phone, credential-manager, or security-key prompt.
The most important choice is storage. A passkey saved only on the Windows device is convenient but does not sync; a synced credential manager or another device can make the credential available elsewhere. This guide explains the choices, exact Windows paths, account-specific setup, and fixes for missing or failed passkey prompts.
As an Amazon Associate I earn from qualifying purchases.
What a Windows 11 passkey does
A passkey replaces a password with a cryptographic credential. The app or website keeps a public key, while the private key remains on your Windows device or in the credential provider you select. During sign-in, the service verifies proof from the private key without receiving the key itself.
Free tools Windows power users keep installed
One-click scans. No signup required.
Passkeys are also tied to the app or website domain. A credential created for one domain should not be offered to an unrelated lookalike domain, which helps prevent phishing. This protection does not mean every Windows app supports passkeys: the individual service must provide a passkey creation or sign-in control.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft describes the underlying design and availability differences in What are passkeys and why they matter.
Before you start
- Confirm that the target app or service advertises passkeys in its account-security or sign-in flow. If no passkey option is offered, Windows cannot add one on its behalf.
- Update Windows and your browser, then use a supported browser. Microsoft lists Microsoft Edge 109 or newer, Chrome 109 or newer, and Safari 16 or newer among supported versions.
- Decide where the credential should live: this Windows device, a synced password manager, a phone or tablet, or a physical FIDO2 security key.
- For Windows Hello, have a device PIN ready. Fingerprint or face unlock additionally requires a compatible fingerprint reader or camera.
- If the account or PC belongs to an employer or school, expect administrator policies to control whether passkeys and particular storage choices are available.
- Stay signed in to at least one existing recovery method while enrolling. A new passkey should supplement your recovery plan until you have successfully tested it.
How to create a passkey from an app or website
- Open the account-security area. Sign in using the existing password or another available method, then look for Passkeys, Security keys, Passwordless sign-in, or Add sign-in method. The exact label belongs to the service.
- Start enrollment. Select Create passkey, Add passkey, or the equivalent. If a prompt says “Create a passkey to sign in?”, select Continue or Create.
- Choose the save location. Accept the suggested destination, or select Change or Save another way when those controls appear. The choices can include Windows Hello, a synced credential manager, a phone or tablet, or a security key.
- Approve the destination. Follow the on-screen instructions. Windows Hello normally asks for your Windows PIN; a configured fingerprint or face method can also be used. A phone flow may display a QR code and request Bluetooth proximity verification. A security key may require USB or NFC connection plus the key’s PIN or touch gesture.
- Verify the result. Sign out or open a private browser window and try the service’s Sign in with a passkey option. Keep another recovery method until you have confirmed that the new credential works.
Some browsers can offer to create a passkey automatically when a compatible site asks for one. If the browser displays a save-location chooser, do not dismiss it without checking which provider is selected. The location determines where the credential can later be found and deleted.
Microsoft’s enrollment instructions for personal and organization accounts are in Create and save a passkey.
Where can the passkey be stored?
| Storage choice | Where it lives | Use on other devices | Unlock or hardware | Important trade-off |
|---|---|---|---|---|
| Windows Hello/device-bound | Locally on the Windows 11 device | Does not automatically sync | Windows PIN; optional compatible fingerprint reader or face camera | Very convenient on that PC, but create a backup method before losing or replacing it |
| Synced credential manager | In the provider’s encrypted credential system | Available on supported devices signed in to that provider | Provider account plus a device screen lock | More portable, but availability depends on the provider, browser, account, and device |
| Phone or tablet | On the nearby mobile device | Can authorize a sign-in on the Windows PC | QR-code flow; Bluetooth may be required; unlock the mobile device | Useful when the phone is always with you, but proximity and connectivity are required |
| Physical FIDO2 security key | On the removable security key | Use the key with compatible computers and services | USB or NFC, key PIN and/or touch | Independent of a particular PC, but it is a separate physical item that must be protected |
Microsoft names Microsoft Password Manager and third-party choices such as Google Password Manager and Apple iCloud Keychain as examples of synced providers. Microsoft Password Manager is rolling out and, according to Microsoft’s documentation, requires Edge 142 or newer with a personal profile.
When Windows Hello is the best choice
Choose Windows Hello when you mainly sign in on one trusted PC and want the shortest daily flow. A PIN is sufficient; biometric hardware is optional. Configure or change Hello at Settings > Accounts > Sign-in options. Microsoft’s hardware and setup guidance is in Configure Windows Hello.
When a synced provider is better
Choose a synced provider if you regularly use several supported devices and want the credential to follow your provider account. The destination may not appear until the browser, provider app, account profile, and device screen lock meet that provider’s requirements.
When to use a phone or tablet
A phone is a practical cross-device authenticator when the Windows computer does not hold the passkey. Scan the displayed QR code, keep the phone near the PC, enable Bluetooth on both devices if requested, and complete the phone’s unlock gesture.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →When a security key is appropriate
A FIDO2 security key is an optional sign-in method, not a prerequisite for Windows Hello. It is useful for people who want a removable credential, for administrators who require hardware-backed authentication, or for a recovery key kept separately from the main computer. Microsoft explains USB and NFC account enrollment in Sign in to your account with a security key.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choosing the right destination
Compare options on five questions: where the private key is stored, whether that location syncs, which devices can use it, what unlock hardware is available, and who controls the account or PC. A device-bound Hello passkey is simplest for a single personal computer, but it must be recreated if that computer is replaced. A synced provider is more convenient across supported devices, but it introduces provider, browser, profile, and screen-lock requirements. A phone is useful for occasional cross-device approval, while a physical key is independent of any one computer and can be kept as a separate backup.
Do not assume that choosing a provider once makes every future passkey use that provider. Each service can present different choices, and a work or school administrator can remove destinations that are available on a personal account. Record the destination after enrollment so you know which settings page to use if you later need to revoke it.
Set up passkeys for a Microsoft account
Personal Microsoft account
Open the account’s security dashboard, enter Advanced security options, and add a passkey as a sign-in method. The dashboard may offer Windows Hello, a synced provider, a phone, or a security key. Complete the selected destination’s authentication prompt, then test the new method before removing an older one.
Work or school account
Use the organization’s Security info page to add a passkey. The tenant must support the feature, and administrators can restrict both passkey enrollment and the destinations users may choose. If the option is absent, contact the organization’s administrator rather than trying to force a consumer setup path.
Personal and organizational enrollment can look different even on the same Windows 11 computer. The account’s policy, not just Windows, determines whether a passkey button appears and whether a security key, phone, or synced provider is permitted.
Manage passkeys saved on Windows 11
- Open Settings.
- Select Accounts.
- Open Passkeys.
- Review the locally stored credentials and select one to delete it when necessary.
This page manages passkeys stored locally by Windows. Credentials synchronized by a password manager must be managed in that provider, and Microsoft account credentials may also be listed in the account’s security dashboard. Microsoft’s local-management instructions are at Manage your saved passkeys.
Deleting a local passkey does not necessarily remove copies held by a synced provider, phone, security key, or the service itself. Remove each copy deliberately, and retain at least one working sign-in or recovery method.
If you see several entries for the same service, identify the storage location before deleting anything. One entry may be a Windows-local credential while another is synchronized or registered from a phone. Removing a copy from Windows does not erase the public-key registration at the service unless you also remove that sign-in method in the service’s own security settings.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do when the passkey option is missing
The app does not offer passkeys
Check the service’s account-security documentation and sign-in page. If it offers only a password, one-time code, or another method, there is no Windows setting that can create a passkey for that account.
The browser or Windows version is too old
Install current updates and retry in a supported browser. Microsoft lists Edge 109+, Chrome 109+, and Safari 16+ in its passkey guidance. The Microsoft Password Manager choice is narrower: Microsoft documents Edge 142+ with a personal profile for that rollout.
The device or account is managed
Work or school policies can hide passkey controls, disable particular providers, or require a security key. A personal-account tutorial may therefore not match a managed Windows installation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The provider does not appear
Check that the provider is installed or enabled in the browser, that you are using the intended profile, and that Windows has a screen lock such as a PIN, fingerprint, or face unlock. Without a screen lock, a synced passkey may not be offered.
Windows Hello is unavailable
Set a PIN under Settings > Accounts > Sign-in options. If you want biometrics, verify that the PC has compatible hardware and that its drivers and Windows Hello configuration are working. You can still use PIN-based Hello without adding a fingerprint reader or compatible camera.
The save dialog closes or loops
Return to the service’s security page and start a fresh enrollment rather than reusing an old prompt. A timed-out browser dialog, an interrupted provider handoff, or a canceled Hello request can leave no passkey registered. Confirm success by checking the service’s list of sign-in methods and by completing a separate sign-in test.
Fix QR-code and cross-device sign-in failures
QR sign-in depends on communication between the Windows browser and the mobile device. Work through these checks in order:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Turn on Bluetooth on both devices when the prompt requires proximity verification.
- Keep the phone or tablet close to the Windows PC and avoid moving it away during enrollment.
- Confirm that both devices have an internet connection if the service requires one.
- Unlock the mobile device and approve the passkey prompt rather than leaving it at the lock screen.
- Restart the QR flow if either device timed out; an expired prompt cannot be reused.
- If the code is unreadable, close the dialog and generate a fresh code instead of repeatedly scanning the old one.
- Make sure the phone is the device that actually stores the passkey. Scanning a code with a different device may authenticate successfully but will not create the credential where you expected.
Microsoft’s troubleshooting checklist covers Bluetooth, proximity, connectivity, timeouts, and device screen locks in Troubleshoot signing in with a passkey.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Replacing a Windows 11 PC or phone
A device-bound passkey remains on its original device and does not sync. Before wiping, selling, or replacing that device, sign in to the service and create a new passkey on the replacement device or in a provider that you can access. Test the new credential, confirm another recovery route, and only then remove the obsolete passkey from the service’s security page.
If the old device is lost or stolen, use the service’s account-security controls from another trusted session to revoke its passkey, change any affected recovery settings, and review active sessions. A synced provider or a separately stored security key can make this recovery easier, but neither removes the need to secure the account itself.
For a phone replacement, verify that the provider’s synchronization has completed before relying on the new handset. If the old phone held the only device-bound credential, use the service’s password, recovery code, second passkey, or security key to enroll the replacement. Never delete the old registration first unless you have already confirmed another working sign-in path.
Recommended Free Tools
Security and recovery checklist
- Use the genuine app or domain before approving a passkey prompt.
- Keep a password, recovery code, second passkey, phone, or security key until the new method has been tested.
- Use a Windows PIN or device lock that only you know; biometrics should be treated as an additional convenience, not your only recovery route.
- Record which provider or device stores each passkey so you know where to manage or revoke it.
- For work or school accounts, follow the organization’s enrollment and recovery policy.
- Review and remove credentials for devices you no longer control.
- Protect a physical security key like a house key: anyone who has it and can satisfy its required unlock step may be able to use it.
- Do not approve an unexpected passkey request. Cancel it and reopen the genuine app or domain yourself.
Common questions
Can Windows 11 create a passkey for any app?
No. The app or service must implement passkey enrollment and sign-in. Windows supplies storage and authentication choices but cannot add support to a service that does not offer the feature.
Do I need a fingerprint reader or face camera?
No. Windows Hello can unlock a passkey with a PIN. Fingerprint and face options require compatible hardware and are optional.
Is a physical security key required?
No. It is one optional destination alongside Windows Hello, a synced credential manager, and a phone or tablet.
Why does a passkey work on one PC but not another?
The credential may be device-bound, the second device may lack the required provider or screen lock, the browser may be unsupported, or an administrator may restrict the available choices.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Where is my Windows passkey stored?
If you selected Windows Hello, it is stored locally on that Windows device. If you selected a synced provider, manage it in that provider’s account or application. A phone flow stores it on the phone, and a security-key flow stores it on the removable key.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Will a Windows Hello passkey appear on my next PC?
Not automatically. A Windows Hello/device-bound credential does not sync. Create and test a new passkey on the replacement PC before removing the old registration.
Why is a synced passkey unavailable even though the provider is installed?
Check the browser version and profile, confirm that you are signed in to the intended provider account, and set a screen lock such as a PIN, fingerprint, or face unlock. Organization policies can also hide the provider.
Can I delete a passkey from Windows and be done?
Only if the Windows-local copy is the one you intend to remove. Synced providers, phones, security keys, and the service’s account-security page can hold separate registrations, so review each location and keep a recovery method.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Frequently Asked Questions
Does every Windows 11 app support passkeys?
No. The individual app or website must offer passkey enrollment and sign-in; Windows cannot add that capability itself.
What is the easiest passkey option on one PC?
Windows Hello is usually the shortest daily flow. It uses a Windows PIN, with optional fingerprint or face unlock when compatible hardware is available.
Do passkeys sync automatically?
Only when you save them with a syncing credential provider. A Windows Hello/device-bound passkey stays on that device.
Why does the passkey choice not appear at work?
A work or school administrator may not support passkeys or may restrict the available destinations. Use the organization’s Security info page or contact its administrator.
What should I check when QR sign-in fails?
Enable Bluetooth when requested, keep both devices nearby, confirm connectivity, unlock the phone, and restart the flow if it timed out.
Is a FIDO2 security key necessary?
No. It is an optional physical storage and sign-in method, separate from Windows Hello.
The Bottom Line
To enable a passkey, the app or website must support it. Start enrollment in that service, choose Windows Hello, a synced provider, a phone, or a FIDO2 key, then complete the destination’s unlock prompt. Remember that Windows-local passkeys do not sync, managed accounts may restrict choices, and every new credential should be tested before an older recovery method is removed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
