A password, a passcode, and a passkey all help keep your stuff safe, but in different ways.
What is a password? A password is a secret word or phrase you type to sign in to a website or app. It's usually longer than a passcode (like a sentence only you know).
What is a passcode? A passcode is a short number code, often 4 to 6 digits, used to unlock a phone, tablet, or other device.
What is a passkey? A passkey is a newer sign-in method that lets your device help prove it's you, using your fingerprint, face, or device lock. You don't need to remember or type a long password.
Think of it like this. A password is a secret phrase you remember. A passcode is a short lock code for your device. A passkey is a trusted helper key built into your device.
Where do you use them? Passwords: websites, school accounts, games, and apps. Passcodes: a phone, tablet, or smartwatch lock screen. Passkeys: newer sign-ins for apps and websites using your device.
Remember: a password is a secret thing you type, a passcode is a short code to unlock a device, and a passkey is a newer sign-in helper using your device. You've got this!
What to remember
- A password is a secret thing you type.
- A passcode is a short code that unlocks a device.
- A passkey is a newer sign-in that uses your device.
- Each one keeps your stuff safe in a different way.
Words to know
- Password
- A secret word or phrase you type to sign in.
- Passcode
- A short number code that unlocks a device.
- Passkey
- A newer sign-in using your device, like a fingerprint.
- Sign in
- Proving it's really you so you can get into an account.
For grown-ups
Three related but distinct things. A password is a memorized secret (word/phrase) used to log into accounts. A passcode is typically a short numeric PIN that unlocks a single device. A passkey is a modern, phishing-resistant credential stored on your device and unlocked by biometrics or the device lock — there's no shared secret to remember, type, or leak. Passkeys are the direction of travel: easier and safer than passwords because there's nothing to phish or reuse.
Want the full story? These go deeper:
