Windows 11 Passkeys Guide: How to Use Windows Hello Sign-In

Table of Contents

Introduction to Passkeys with Windows Hello in Windows 11

Passkeys with Windows Hello in Windows 11 let you sign in to your Microsoft account, work or school account, and supported websites with your PIN, fingerprint, or face instead of a password. You need Windows Hello set up first, and you manage saved passkeys under Settings > Accounts > Passkeys.

How Passkeys Replace Traditional Passwords

A passkey replaces a password by eliminating secrets that can be phished or leaked in a data breach, relying instead on Windows Hello authentication. Each passkey functions exclusively for the specific website or app created for it, preventing fake login pages from exploiting credentials since the target site stores no password. Cryptographic operations occur automatically behind the scenes without requiring direct user configuration.

Understanding Passkey Save Locations and Device Constraints

Where you save a passkey decides where you can use it:

A passkey saved to This Windows device stays on that PC and isn’t transferred or restored. If you reset or replace the PC, that passkey is no longer available, even if the account still lists it as a sign-in method, so keep another sign-in method on the account.

Older supported Windows versions can still use passkeys, but the full management experience in Settings is Windows 11-specific (Microsoft Learn: Support for passkeys in Windows).

Expected result: Passkeys appears as an entry under Settings > Accounts.

Configuring Windows Hello and Managing Passkeys

Passkeys saved to Windows are protected by Windows Hello, so you need at least one method set up.

Expected result: The PIN entry shows as set up. If your PC lacks a fingerprint reader or IR camera, the biometric options are unavailable. A USB fingerprint reader or Windows Hello-compatible webcam adds them, but the PIN works fine on its own.

Expected result: The passkey appears in the sign-in methods list on your Microsoft account security page (Microsoft Support: Create and save a passkey).

Work and school accounts depend on your organization’s settings, including tenant policy, which authentication methods are enabled, and your account type. The option may also be labeled differently, such as Passkey or Passkey in Microsoft Authenticator. If your IT admin hasn’t allowed passkeys, the option won’t appear.

Expected result: The passkey shows in your security info list. If you don’t see a passkey option, ask your IT team whether passkeys are enabled for your account.

Using Passkeys Across Websites and External Devices

Each site labels this differently, and Windows can’t add passkey support to a site that doesn’t have it.

Expected result: You’re signed in without typing a password (Microsoft Support: Use a passkey in Windows).

Deleting a passkey here only removes the copy on this PC. The account still lists it as a sign-in method, so remove it there too (Microsoft Support: Manage your saved passkeys):

Turn it off on a shared PC if you’d rather keep passkeys on a phone or security key. Depending on your Windows version and the passkey providers you have installed, this page may also list third-party passkey managers you can turn on. If you don’t see any, your provider or Windows build doesn’t support that integration yet.

Troubleshooting Passkeys and Windows Hello Integration

Windows added the Passkeys page in Windows 11, version 22H2, with KB5030310, and later fully updated releases include it.

Biometric options need compatible hardware. Set up PIN (Windows Hello) under Settings > Accounts > Sign-in options instead. If the PIN itself stops working, see our guides on how to reset a forgotten Windows Hello PIN and what to do when Windows Hello is not working.

This option can be hidden if the local save setting is off. With some providers, a passkey you’ve already saved for that account to a synced credential manager may also change which save location Windows offers.

A passkey created on your phone or security key won’t appear on a new PC. At the sign-in prompt, select Use another device and choose iPhone, iPad or Android device, Linked device, or Security key.

If you deleted a passkey in Settings but it still shows on your account, remove it from the account’s security page as described in the Configuration section.

The site has to build passkey support itself. If its security settings have no passkey option, keep using its regular sign-in method with two-factor authentication.

Choosing the Right Passkey Storage Strategy

For most people, saving a Microsoft account passkey to This Windows device and confirming with a Windows Hello PIN is the quickest win. It works with no extra hardware and kills off the password you’d otherwise type every day. If you use several PCs, a synced passkey or a FIDO2 security key like a YubiKey is the better long-term choice, because a device-bound passkey disappears when the PC does. The trade-off: a synced passkey depends on that provider’s account, while a security key travels anywhere but has to be carried and kept safe. If Windows Hello keeps failing after updates, suspect a faulty biometric sensor or driver before blaming passkeys.

Save location	Where it works	Best for
This Windows device (Windows Hello)	Only on this PC	A personal PC you use every day
Microsoft Password Manager or another synced provider	Other devices signed in to that provider	People who switch between devices
Phone or tablet	That phone; where supported, you can use it to sign in on a PC via a cross-device flow such as a QR code	Users who always have their phone nearby
Physical security key	Any PC you plug the key into	Shared or high-security PCs

Step	Action	Applies To
1	Install current Windows updates	All users
2	Set up Windows Hello PIN or biometrics	All users
3–5	Create a passkey	Microsoft, work/school, other sites
6	Sign in, or use another device	All users
Config	View, delete, control local storage	Settings > Accounts > Passkeys