Passkey Login: How to Sign In Without a Password

Passkey login is the simplest and safest way to get into your account: instead of a password, you sign in with the same face scan, fingerprint, or security key you already use to unlock your device. There’s nothing to memorise, nothing to type, and — crucially — nothing a scammer can phish or a breach can leak. EmailAlias supports passkey login on every plan, for free. This guide explains what a passkey is, how passkey login works, and how to set one up and use it in a couple of minutes.

What a Passkey Is

A passkey is a modern replacement for a password. Instead of a secret string you type, it’s a pair of cryptographic keys created on your device. The private half never leaves your phone, laptop, or security key; the public half is stored by the site. To sign in, your device proves it holds the private key — and it only unlocks that key after you confirm with your face, fingerprint, or device PIN.

In everyday terms: a passkey turns “type a password you might forget or reuse” into “confirm it’s you with a fingerprint.” It’s built on the FIDO2 / WebAuthn standard, the same technology behind passwordless sign-in at major banks and tech companies — so it’s proven, not experimental.

It’s easy to confuse a passkey with the two-factor codes you may already use, but they’re quite different. An authenticator app or an SMS code is an extra secret layered on top of a password — one more thing to type, and one more thing that can be phished, intercepted, or relayed. A passkey isn’t a second factor bolted onto a password; it replaces the password entirely with something that can’t be typed at all. There’s no code to read out, no string to enter, and nothing to copy from one screen to another. The “something you have” (your device) and the “something you are” (your fingerprint or face) are fused into a single action, which is why a passkey manages to be both stronger than a password-plus-code setup and simpler than either part of it on its own. Understanding that distinction is the key to seeing why passkeys are treated as a genuine upgrade rather than just another login hoop.

How Passkey Login Works

When you sign in with a passkey, EmailAlias sends your device a one-time challenge. Your device unlocks the private key — after you confirm with biometrics or your PIN — and uses it to sign that challenge. EmailAlias checks the signature against the public key it has on file, and if it matches, you’re in. No password is ever sent, stored, or typed.

What you actually experience is much simpler than that sounds: you enter your email, choose “Sign in with passkey,” and your device prompts for Face ID, Touch ID, Windows Hello, or your hardware security key. A second later, you’re signed in. The cryptography happens invisibly; on your side it’s just a quick biometric check.

A couple of details make the design especially reassuring. Your biometric data — the actual scan of your face or fingerprint — never leaves your device and is never sent to EmailAlias; it’s used only locally to unlock the private key, so the site never sees it. And because the private key is created on your device and stays there, there’s nothing on EmailAlias’s servers that could be stolen and turned into a login. A breach of the site can leak the public keys, but a public key is useless to an attacker by design — it can verify a signature but can’t produce one. That’s the structural advantage over passwords: with a password, the thing the server stores is (a protected version of) the very secret an attacker needs, whereas with a passkey the server only ever holds the half that’s safe to be public.

How to Set Up Passkey Login

You add a passkey while signed in, so start by logging in as you normally would. Then:

1. Open Settings. Go to your dashboard and find the Passkeys section in Settings.
2. Add a passkey. Click Add passkey. Your device takes over and asks you to confirm with Face ID, Touch ID, Windows Hello, or a hardware security key.
3. Name it. Give the passkey a nickname like “iPhone” or “Work laptop” so you can tell your devices apart later. (It’s optional, but helpful once you have more than one.)
4. Done. The passkey is registered to your account and ready to use the next time you sign in.

That’s the whole setup — no password to choose, no recovery codes to print. You can repeat it on each device you use, up to five passkeys per account, so your phone and laptop can each have their own. It’s a free feature on every plan, and it sits alongside the account you already created; if you haven’t set one up yet, our guide on creating and managing aliases covers getting started.

How to Sign In With a Passkey

Once you’ve registered a passkey, signing in is quick:

1. Enter your email on the login page.
2. Choose “Sign in with passkey.” This button appears when your browser supports passkeys.
3. Confirm it’s you. Your device prompts for your face, fingerprint, or security key.
4. You’re in. No password, no code from an email — just the biometric check.

Your existing sign-in options don’t go away. A passkey supplements your other methods, so you can still use a magic link (the login link sent to your email) or a password if you set one. If you’re ever on a device without your passkey, you fall back to the magic link. Passkeys simply make the everyday case — signing in on your own phone or laptop — faster and safer.

Passkey vs Password

Passkeys fix the fundamental weaknesses of passwords. Here’s how they compare.

The pattern is clear: everything that makes passwords risky — they can be phished, leaked, reused, and forgotten — simply doesn’t apply to a passkey, because there’s no shared secret to steal in the first place. And it’s more convenient on top of being safer, which is a rare combination in security.

Why Passkeys Resist Phishing

The single biggest advantage of a passkey is that it’s phishing-resistant. A passkey is cryptographically bound to the real EmailAlias domain. If you land on a convincing fake login page — the kind used in phishing attacks — your passkey simply won’t work there, because the site’s identity doesn’t match. There’s no password to be tricked into typing, so the classic “enter your login on a lookalike site” scam has nothing to steal.

This matters because phishing and spoofing are how most account takeovers actually happen — not by cracking encryption, but by fooling a person into handing over a password. A passkey removes the thing the attacker is after. Combined with using aliases so your login address is harder to target in the first place, it closes one of the most common doors into an account.

It also defeats the more advanced phishing kits that can defeat ordinary two-factor codes. When you type a one-time code into a fake page, a sophisticated attacker can relay it to the real site in real time and get in anyway — the code is just another secret you can be tricked into revealing. A passkey can’t be relayed like that, because it never produces a secret you type; it signs a challenge that is bound to the genuine site’s identity, and that binding is checked by your own device. So even a pixel-perfect clone of the login page, wired straight to the real one behind the scenes, comes away with nothing. That resistance to real-time relay is what puts passkeys a clear step above passwords-plus-codes, and it’s why security teams increasingly treat them as the strongest practical option for everyday sign-in.

Where Passkey Login Works

One reason passkeys have taken off is that the pieces are already in your pocket. Passkey login works anywhere you have a device that can verify it’s you — which, these days, is almost everything.

• Phones and tablets. Modern iPhones, iPads, and Android devices all support passkeys through Face ID, Touch ID, or fingerprint unlock. Your phone is usually the easiest place to create your first passkey.
• Laptops and desktops. Macs (Touch ID), Windows PCs (Windows Hello face or fingerprint, or a PIN), and Linux machines with a compatible authenticator all work in an up-to-date browser.
• Hardware security keys. A physical key (the USB or NFC kind) can hold a passkey too — a good choice for a backup or for the highest-security setups.

On many platforms, your passkeys also sync across your own devices through your account’s keychain, so a passkey you create on your phone can be available on your laptop without setting it up twice. Because it builds on public-key cryptography, the private part still never leaves your protected keychain — syncing moves it securely, it doesn’t expose it. If a device or browser doesn’t support passkeys yet, nothing breaks: you simply sign in with your magic link there instead, and use the passkey on the devices that do support it.

It’s worth thinking of a passkey as the login equivalent of the habits that protect the rest of your email. Just as you’d avoid handing out your real email address everywhere and route signups through aliases instead, a passkey removes the reusable secret at the front door. It sits alongside broader account hygiene — a strong, unique approach to each login rather than one password stretched across everything — and is a natural complement to multi-factor authentication thinking, except it rolls the “something you have” and “something you are” into a single tap.

Managing Your Passkeys

Passkey management lives in the same Settings section where you created them:

• Add up to five. Register a separate passkey on each device you use — your phone, your laptop, a backup security key — up to five per account. Each shows its nickname and when it was last used.
• Name them clearly. A good nickname (“Personal iPhone”, “Work MacBook”) makes it obvious which is which, especially when it’s time to remove one.
• Remove one anytime. Lost a device or replaced a laptop? Delete its passkey from Settings and it can no longer be used to sign in. Your other passkeys and login methods are unaffected.
• Keep a fallback. Because the magic link still works, losing a device never locks you out — you can always sign in by email and re-add a passkey on your new device.

Final Thoughts

Passwords are the weakest link in almost every account — forgotten, reused, phished, and dumped in breach after breach. Passkey login sidesteps all of it: you sign in with your face or fingerprint, nothing secret is ever stored or sent, and a fake login page has nothing to steal. It takes a few seconds to set up from Settings, it’s free on every plan, and your magic link stays as a backup so you’re never locked out. If you use EmailAlias to keep your email private, adding a passkey is the natural next step — it keeps the account guarding all those aliases just as private and hard to break into.

Frequently Asked Questions