Sign in with a passkey

Sign in with a passkey

A passkey replaces your password with the thing that unlocks your device: Touch ID, Face ID, Windows Hello, or a hardware security key.

It is the single biggest security improvement available on your account, and it takes about twenty seconds to set up.

Why it is better than a password

• It cannot be phished. The key is bound to my-id.ca itself. A convincing fake site cannot receive it, because your device will not offer it there.
• It cannot be reused. There is nothing to leak in a breach elsewhere, because there is no shared secret.
• It cannot be guessed. No password to be short, old, or in a list.
• It is faster. A fingerprint instead of typing.

Setting one up

1. Open Settings → Passkeys.
2. Type a device name — "My iPhone", "Work laptop". This is only for you, so you can tell them apart later.
3. Click Register a passkey.
4. Your device asks you to confirm with fingerprint, face, PIN, or security key.

Done. The passkey appears in the list.

What the list shows

Each passkey shows its device name, and underneath:

• The domain it is bound to
• When it was added
• When it was last used, or "Never used"
• Synced, if your platform is backing it up across your devices

Remove deletes one, with a confirmation. Removing a passkey does not affect your password or your other passkeys.

Passkeys are bound to one domain

A passkey registered on my-id.ca does not appear on hivi-x.ca, and vice versa. This is a property of how passkeys work, not a limitation of the app — the domain binding is exactly what makes them unphishable.

If you use both sites, register a passkey on each.

Passkeys and two-factor authentication

Signing in with a passkey skips the authenticator-app prompt. That is intentional.

Two-factor authentication exists to add a second factor to a password, which is only one. A passkey is already two: possession of the device, plus the biometric or PIN that unlocks it. Asking for a code as well adds friction without adding security.

Keep two-factor authentication enabled anyway — it still protects any sign-in that uses your password, for example on a device where you have not set up a passkey. See Turn on two-factor authentication.

Recommended setup

1. Register a passkey on your phone. It is the device you always have.
2. Register a second on your main computer. Redundancy matters more than tidiness.
3. Keep two-factor authentication on for password sign-ins.
4. Keep your password strong — it remains the recovery path.

Two passkeys plus 2FA is a genuinely hard account to take over.

If a passkey stops working

• Your device was reset or replaced. The key is gone with it. Sign in with your password, then register a new passkey and remove the old entry.
• The browser does not offer it. Passkeys need a current browser and a device with a screen lock. Check the device actually has a lock set.
• You are on the wrong domain. Check the address bar — see the domain-binding section above.

Related

• Turn on two-factor authentication
• High security and your account
• Sign out and shared devices