Why am I being asked for a Passkey? How do I turn off passkeys?

Anonymous
2024-07-22T21:51:35+00:00

I was opted into this without my knowledge, or without understanding how it works.

I have a solid understanding of Windows, and the security around it. But I do not understand why I suddenly am being forced to use, and constantly asked about passkeys, when I have not opted into them or set them up.

If I don't understand why I am being forced to use these, or why they are required, none of the less savvy users will. This will likely result in Microsoft spending more on tech support due to people being locked out of their devices.

Scenario: I have deleted the passkeys from my settings, and now my Edge logins have a discrepancy, because they are demanding passkeys that no longer exist.

For some reason, Windows is not allowing me to delete my Microsoft Passkey, because now that is required to sign in to my computer. I already have a PIN, a password, a fingerprint, and my face to sign in to my computer.

Is the only option logging out of my Microsoft Account and making it a local account to opt out of passkeys?

Passkeys need to be explained better if they are going to be a requirement, it needs to be a more gentle introduction.

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Rob Koch 26,160 Reputation points Volunteer Moderator
2024-07-23T03:59:03+00:00

You've been using a passkey to login to Windows since you enabled Windows Hello to perform Face, Fingerprint or PIN login methods, since they' re an integral part of that system. They simply weren't as visible in the past, since the Passkey Management and using them for 3rd-party apps or websites weren't yet supported.

As usual, the problem is there are many documents available covering these and some confusing differences between the Azure Business-based systems using something called Entra for authentication and the consumer version of these related to your Microsoft Personal account. I'll include documents from both here in case you are more technically interested but tell you which I'm providing.

The first is an overview for consumer accounts and should help you understand how crucial they are to Microsoft's future authentication systems intended to remove the need for passwords, so trying to escae them is utterly pointless.

New passkey support for Microsoft consumer accounts | Microsoft Security Blog

This next one has more technical detail and in the first sections describes in general how they work, while a later section is specific to the Microsoft implementation and shows how these functions relate to Windows Hello, the Edge browser and other similar portions of Windows. I wouldn't typically provide this to the average consumer, but it really makes their operation on Windows clear for those wanting to understand them more deeply.

WebAuthn APIs - Windows Security | Microsoft Learn

I think I'll stop there for the moment to make sure you want more iformation, since upon quick review, these two documents cover the basics, while there are many others that provide the How-to explanations for individual portions of passkey operation.

Rob

< EDIT > BTW, here's a FAQ document with some common questions about passkeys, the last of which is titled; How can I provide feedback about my experience with passkeys?

Passkeys frequently asked questions (FAQ) - Microsoft Support

If you click the question to view the answer, you'll find a link to the Windows Feedback where you can submit your comments directly to Microsoft. Anything you post in this forum will only be seen by those who browse here, while virtually no Microsoft employees ever do and so your posts here are only really seen by us volunteer or a few contract helpers.

Was this answer helpful?

10+ people found this answer helpful.
0 comments
Answer accepted by question author
quietman7 MVP Alumni 19,830 Reputation points Volunteer Moderator
2025-06-22T21:08:03+00:00

I appreciate your response. If a password and the multi-authentication code is not sufficient, what does a 'passkey' do?

Why doesn't Microsoft provide some easy-to-understand explanation of what a 'passkey' is and why it is different for every site?

I provided that information in a previous reply (page 11) but here are those and some more links by Microsoft with explanations.

Passkeys Authentication Across Platforms - How Passkeys Registration and Authentication Work Across Devices and Platforms

Quote

To combat such risks, phishing-resistant Passwordless authentication methods, including enhanced support for Microsoft Authenticator, have become critical.

Just for the record...Microsoft has long been a proponent of passwordless authentication for years so this is nothing new. Other industries have been moving in that direction too. .

In a nutshell...Passkeys are stored as secrets locally on a device and use a device's unlock mechanism such as Windows Hello biometrics (fingerprint or facial recognition) or PIN sign-In options to authenticate them before signing in. Passkeys can be used without the need for other sign-in challenges, making the authentication process faster and more convenient. A passkey is invisible, virtual and employ public-key cryptography (keypair concept: a private key and a public key). The passkey is purposely hidden from access inside the TPM (Trusted Platform Module).
 
A TPM chip is an embedded crypto-processor in laptops and is designed to provide hardware-based, security-related functions (carry out cryptographic operations. The TPM is isolated from the main processor and functions as a vault (a lockbox for keys) so in the event of malware attack or breach, sensitive user data remains secure.

Was this answer helpful?

3 people found this answer helpful.
0 comments

129 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2025-04-05T08:30:39+00:00

    Passkeys are the replacement for the passwords we have been using since always. It's actually easier to use a passkey than to use a password, and passkeys are many times more secure than passwords.

    ^^ This statement contains a lot of nonsense. Passkeys are a public/private key implementation and are probably good for casual users. For more advanced users, I think not.

    A good random password in a password database (maybe 512+ characters) properly implemented with substantial unique salt on the server is actually quite a bit more difficult to brute force than a passkey.

    Passkeys allow anyone with your device to have access to everything(assuming it is unlocked and decrypted of course that is implied in "access")

    Passkeys or any strings based on biometrics are immutable and permanent, so when stolen (and they will be) you have no recourse. You will be catapulted into stolen identity hell and have to manually contact every single site using that passkey.

    They like to say passkeys are immune to phishing but this is not the case, as a session can be a perfectly good attack surface for a malicious actor. There is also this CVE which shows a simple vulnerability via BlueTooth and the potential for similar vulnerabilities in the future. https://mastersplinter.work/research/passkey/ If root access to a passkey store is obtained, the entire passkey store and all the accounts can be compromised, just like any other system. External MFA can be used to mitigate this, but it is being touted as an advantage that you don't need it, so in that case all the accounts are compromised.

    So this push to force everyone into passkeys is creating an unnecessary honeypot and people with good security practices would be better served with PASSWORDS.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Rob Koch 26,160 Reputation points Volunteer Moderator
    2025-04-04T22:20:00+00:00

    Hey Rob!

    Hopefully you get this. I am having an infuriating issue where Windows forces my browsers to ask for a passkey. Except the passkey isnt my passkey, and then when I try to cancel it freezes my browser and I can't do anything. The really weird part is that it only seems to do it with accounts I almost never use, tonight it is Yahoo Sports. Both in Firefox and Chrome I try to login to yahoo and it prompts me for a usb key security, which I don't now nor have ever owned. I have searched all through the settings of both web browsers, watched videos for turning off windows Hello in the browsers, etc. I am beyond frustrated, I actually want to throw my PC in the river.

    How do I turn this off?

    Thanks,

    Dave

    David, though I have no idea why you're having this problem, it's really a problem with those non-Microsoft browsers, since it's the browser you're using that generates the request to Windows to display any dialog relating to passkeys, not Windows itself.

    Though it's potentially still a problem relating to the use of passkeys themselves, Windows doesn't fire that dialog for no reason, so I suspect that something exists on your PC that's making the browsers believe a passkey exists to support those websites.

    This isn't the correct place to ask a new question, since the issues discussed her are general and not related to any specific troubleshooting. You can look through this thread for a post by SirBlain that claims to show how he disabled passkeys on his own Windows 10 system, though as I recall it was fairly extreme and not something most users would likely wish to do. It's also possible that post was in another thread, but maybe he'll reply to you if he sees your question to offer his solution.

    As I've mentioned, I'm personally not even trying to use passkeys with Windows 10 due to the fact it has no real support for managing the keys and thus no ability to fix problems that crop up. However, in my case this only leads to an added item for my phone being displayed in the popup lists, which since I always use Windows Hello Face (IR camera) for login or verification, really doesn't create any additional issues beyond the phone being displayed.

    You'd be better off creating your own new thread to trouble-shoot your issue, since then others might see it who are truly using passkeys at present and you can detail other necessary items like the version of Windows you're using, etc., that might be important to your problem.

    FYI, when I initially tried to setup a passkey to login to my Amazon account long before Microsoft was advertising their use widely almost 2 years ago, I did manage to get it set up on my phone, but then discovered that Amazon still requires you go through the same 2nd verification step of entering a TOTP Code sent to your phone, which is pointless since passkeys are inherently 2-Factor due to the fact it requires something you have (the phone), along with something you are (the Biometric Face or Fingerprint access to the passkey), which meant Amazon clearly didn't understand what they were doing. Only after that did I discover the inability to manage passkeys with Windows 10, which caused me to stop trying to use them until I get a Windows 11 device. IOW, nothing wrong with passkeys themselves, just implementation problems by Amazon (and likely others) along with management issues using Windows 10.

    Rob

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2025-04-04T00:04:50+00:00

    Hey Rob!

    Hopefully you get this. I am having an infuriating issue where Windows forces my browsers to ask for a passkey. Except the passkey isnt my passkey, and then when I try to cancel it freezes my browser and I can't do anything. The really weird part is that it only seems to do it with accounts I almost never use, tonight it is Yahoo Sports. Both in Firefox and Chrome I try to login to yahoo and it prompts me for a usb key security, which I don't now nor have ever owned. I have searched all through the settings of both web browsers, watched videos for turning off windows Hello in the browsers, etc. I am beyond frustrated, I actually want to throw my PC in the river.

    How do I turn this off?

    Thanks,

    Dave

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments