Verified October 2026 against PlayStation, Xbox and Microsoft support pages.
A passkey lets you sign in to your PlayStation Network account or your Microsoft account (the one you use on Xbox) with your phone's face, fingerprint or screen lock instead of typing a password. Both Sony and Microsoft offer passkeys today. The main thing they change is that a fake sign-in page can no longer trick you into handing over something reusable, but a passkey does not replace good recovery options if you lose the device that holds it.
What a passkey actually is
Sony describes a passkey as a password replacement that you use with a fingerprint, a face scan or your screen lock PIN. Microsoft puts it the same way: instead of typing a password, you confirm on your phone or device that it is really you. The passkey itself is kept by your phone, computer or passkey manager.
Three details matter for game accounts:
- There is nothing to type or remember. No password travels to the sign-in page, so there is nothing for someone to copy.
- A passkey is tied to one service. Microsoft describes passkeys as unique to each website or app and resistant to phishing, so a lookalike page has nothing reusable to collect.
- It can sync. Many passkey managers copy your passkeys to your other signed-in devices, such as a tablet or laptop. That is convenient, and it also matters for recovery.
Where PlayStation and Microsoft offer passkeys
PlayStation Network
Sony lets you create a passkey from Account Management on the web, under the Security section, with an option called Sign in with Passkey. On a PS5 it is under Settings > Users & Accounts > Account > Security > Sign in with Passkey, and you finish by scanning a QR code with your phone. Sony's help page says passkeys work on most phones with iOS 16 or later or Android 9 or later, and in up-to-date Safari, Chrome or Edge. It also advises against using a PIN code as a passkey on Android. Sony also names adding a passkey among its security best practices. See PlayStation's passkey setup page for the current steps.
One side effect to know about: PlayStation notes that its Password at Checkout setting is not compatible with passkey accounts. If you rely on Require Password at Checkout to stop unwanted purchases, check PlayStation's page before switching to a passkey, and compare your purchase-lock options in the side-by-side comparison linked further down.
Microsoft account for Xbox
Your Xbox profile signs in with a Microsoft account, and Microsoft lets personal accounts add a passkey from the Advanced security options page: choose Add a new way to sign in or verify, then Face, Fingerprint, PIN, or Security Key. The passkey can be saved in Microsoft's own password manager or another one you use. Microsoft also offers a passwordless setup with the Microsoft Authenticator app. The wording of menus changes from time to time, so check Microsoft's passkey help article for the current path.
Watch out for a naming trap on Xbox consoles. Xbox once used the word "passkey" for the code you can set for your console profile: its help page is now titled Manage a PIN for your XBOX profile, but its web address still contains "passkey". That code is a PIN on your Xbox profile that works on any console you sign in to, and you can require it for sign-in and purchases. It is not a web passkey on your Microsoft account.
What a passkey protects you from
In our experience, phishing is a common route into game accounts: a message about a "suspended account", a free code or a trade, followed by a page that looks like a real sign-in screen. With a password, typing it into that page gives it away. With a passkey, the lookalike site cannot request your passkey, and you have no password to type there in the first place.
A passkey on its own does not retire your password. A reused password stops being a risk only once the account no longer accepts a password at all. On Microsoft that is the separate passwordless setting, which needs a method such as the Microsoft Authenticator app. PlayStation also offers a way back to password sign-in. For the full picture of how these lures work, read our guide to spotting PlayStation and Xbox phishing messages.
What a passkey does not protect you from
- Losing the device. If your only passkey lived on a phone that is lost or reset and was not synced anywhere, you need another way in. Sony says that if another device uses the same passkey manager, you can still sign in there and register a new passkey; otherwise you go through its recovery routes or PlayStation Support.
- A weak email account. Your sign-in email is still the key to password resets and security notices. If someone controls it, they can cause serious trouble regardless of your passkey.
- Handing over approval. Scams that ask you to scan a QR code or approve a sign-in for someone else still work if you go along with them. Sony specifically warns about QR code scams.
- Everything else on the account. A console where your account is already signed in stays signed in; adding a passkey does not change that, in our understanding. On PlayStation, Sony presents a passkey as a switch away from 2-step verification, and its terms say some sign-in methods may turn off your current 2-step verification, so after adding one, open Security in Account Management and check what is still on. On Microsoft, keep your recovery code safe either way.
If you are already locked out because your phone is gone and 2-step is on, our guide on getting back into PSN after losing your phone covers backup codes and the passkey route in order.
Is it worth turning on?
For most account holders, yes, as one layer among several. A passkey removes the weakest link, a password that can be phished or reused, without adding much effort at sign-in. It works best when you also keep an up-to-date recovery email, store your backup codes or Microsoft recovery code offline, and know which devices are signed in. The two platforms name and place these settings differently, which our side-by-side comparison of PSN and Xbox security settings lays out.
What to do next
- Check that you can open the email account linked to your PlayStation or Microsoft account, and secure it first.
- Add a passkey using the official PlayStation or Microsoft steps linked above, ideally in a passkey manager that syncs to a second device you own.
- Save your backup codes or recovery code somewhere offline.
- Work through the rest of our PSN and Xbox account security checklist.
PlayStation tells you never to share your account details with anyone, and Microsoft says it does not send unsolicited messages asking for personal information and that its support agents cannot send password reset links. Never approve a sign-in you didn't start yourself. If a request like that arrives, treat it as a scam and go to the official site yourself.