Sign in with a passkey
Sign in with a passkey
A passkey replaces your password with the thing that unlocks your device: Touch ID, Face ID, Windows Hello, or a hardware security key.
It is the single biggest security improvement available on your account, and it takes about twenty seconds to set up.
Why it is better than a password
- It cannot be phished. The key is bound to
my-id.caitself. A convincing fake site cannot receive it, because your device will not offer it there. - It cannot be reused. There is nothing to leak in a breach elsewhere, because there is no shared secret.
- It cannot be guessed. No password to be short, old, or in a list.
- It is faster. A fingerprint instead of typing.
Setting one up
- Open Settings → Passkeys.
- Type a device name — "My iPhone", "Work laptop". This is only for you, so you can tell them apart later.
- Click Register a passkey.
- Your device asks you to confirm with fingerprint, face, PIN, or security key.
Done. The passkey appears in the list.
What the list shows
Each passkey shows its device name, and underneath:
- The domain it is bound to
- When it was added
- When it was last used, or "Never used"
- Synced, if your platform is backing it up across your devices
Remove deletes one, with a confirmation. Removing a passkey does not affect your password or your other passkeys.
Passkeys are bound to one domain
A passkey registered on my-id.ca does not appear on hivi-x.ca, and vice versa. This is a property of how passkeys work, not a limitation of the app — the domain binding is exactly what makes them unphishable.
If you use both sites, register a passkey on each.
Passkeys and two-factor authentication
Signing in with a passkey skips the authenticator-app prompt. That is intentional.
Two-factor authentication exists to add a second factor to a password, which is only one. A passkey is already two: possession of the device, plus the biometric or PIN that unlocks it. Asking for a code as well adds friction without adding security.
Keep two-factor authentication enabled anyway — it still protects any sign-in that uses your password, for example on a device where you have not set up a passkey. See Turn on two-factor authentication.
Recommended setup
- Register a passkey on your phone. It is the device you always have.
- Register a second on your main computer. Redundancy matters more than tidiness.
- Keep two-factor authentication on for password sign-ins.
- Keep your password strong — it remains the recovery path.
Two passkeys plus 2FA is a genuinely hard account to take over.
If a passkey stops working
- Your device was reset or replaced. The key is gone with it. Sign in with your password, then register a new passkey and remove the old entry.
- The browser does not offer it. Passkeys need a current browser and a device with a screen lock. Check the device actually has a lock set.
- You are on the wrong domain. Check the address bar — see the domain-binding section above.
Related
Frequently asked questions
- Why does signing in with a passkey skip my 2FA code?
- Because a passkey is already two factors — something you have (the device holding the key) and something you are or know (the fingerprint, face, or PIN that unlocks it). Adding a code on top adds friction, not security.
- What if I lose the device?
- Register a passkey on more than one device, and keep your password and authenticator app as fallbacks. If a passkey is synced through your platform account, it may already be on your other devices.
- My passkey does not appear on the other site.
- Passkeys are bound to the domain they were registered on. One registered on my-id.ca will not show up on hivi-x.ca. Register separately on each if you use both.