passkeys - each web account (ex. Amazon or Paypal) need a different passkey?

"Thanks for your effort to get me educated. I can't upgrade my w10 PC to w11 so I will not use passkeys for some time. As to HELLO - I don't even know what that is. When I boot the PC I enter a 4-digit number that MS calls a pin. I do not know how that got started. I use no biometrics and no face reader."

As I tried to imply in my first post above, Windows Hello is what stores your PIN, and if you actually had either Face (IR camera) or Fingerprint reader in your device as I do, those security identifiers as well in your PC's TPM. However, since yours is obviously an older device possibly upgraded to Windows 10, it may either have a much older TPM 'chip' or actually none at all, since that was still acceptable when Windows 10 upgrades from Windows 7 or 8.x were first allowed back in 2016.

That's another reason I mentioned Biometrics and the fact they're a desirable addition when you move to Windows 11, since Windows Hello is such an important portion of these new authentication systems that Microsoft quietly added into your Windows 10 with the inclusion of the PIN used for login in place of typing your password as you'd always done in the past, which were the first baby steps towards the passwordless login using passkeys that's where that process is evolving today.

"I logged into Amazon a few minutes ago on my Android phone (not using any biometrics) and it asked me for the passkey (which I have never messed with). I entered the same 4-digit number that MS calls my pin, and it logged me in to Amazon. I think the same happens when I use my phone to login to PayPal. I do not understand why this is happening. I have never gone thru any scenario to generate a pass code anywhere."

Based on your description that logging into Amazon on your phone requested that you type your PIN, which must actually be the same 4-digit number as your Windows device since you mentioned those were the same, and also the fact that the login dialog mentioned a passkey, you must have somehow gone through the passkey setup process using the phone in the past and simply don't recall the steps you took.

I say this because I just decided to set up an Amazon passkey in my Google Password Manager on my own Android based Pixel 8 phone, since it's really the Windows 10 itself that hadn't worked well with this for me in the past, while I'd never truly tried using it with the phone itself at the time since I don't typically used my Amazon account on that device. The setup wasn't as easy as it should have been, since initially my Microsoft Surface Go tablet and Pixel 8 phone couldn't properly 'see' each other via Bluetooth, which is a requirement for using the passkey stored on the phone to login from another device. This should technically have worked without 'pairing' the two devices as I did, but possibly that was a side effect of my earlier attempts that had at least initially failed but eventually worked with at least one of the two legacy Pixel 8 devices that I deleted in order to set it up again manually.

However, the login process I went through to use the passkey on the phone while logging into the tablet was different than I recall last year, since it initially wanted me to enter my username, then prompted me for either the password or 'sign-in with a passkey', which then popped up first the selection of either Windows Hello (which doesn't work with Windows 10) or Use a Phone or tablet instead which I selected, and finally displayed a QR Code on the tablet I needed to scan using the phone for the login to proceed. Note: The prompt for password or 'Sign-in with a passkey' has been skipped ever since that first time, since it now has the relationship between the devices stored and goes directly to the QR code screen for me to scan it.

"What happens when my PC and its passcodes burn to a crisp in a fire? Or how do I login to a website (like Amazon) from a friend's PC when I don't have my phone with me?"

I'll continue the above here, since your questions refer to passcodes, which are something entirely different that you need to understand so you don't confuse them in the future.

Since I have my Amazon account set to request an OTP (actually a TOTP - Time-based One-Time Passcode) as my existing form of Two-Factor authentication, the login process then requested this redundant piece of information from the Microsoft Authenticator app I also have installed on my phone. I say it's redundant since the passkey itself is actually far more secure, since unlike the 6-digit TOTP passcode I manually type into the box Amazon offers for that purpose, the encrypted passkey information is instead automatically sent back and forth as required between the phone where it's stored and Amazon, with the Bluetooth connection between my devices and the QR code that I was asked to scan during the tablet login doing all of the added work with no other manual typing of codes or other data from me.

That's why everything you'll read about passkeys says that unlike the OTP passcodes, the passkeys aren't easily phishable, since there's nothing for you to type and so nothing that an attacker can ask you to provide that should allow them to bypass this process by tricking you, since unless they're standing right next to you, they'd have no way to gain access to either the device(s) or scan the QR code from your PC screen in order to do this, which are still basically worthless for any other device.

Returning to your other related questions, if your phone is lost or stolen, you'd obviously have lost any passkeys stored on it, but other than Microsoft that has the option to disable your password entirely to go truly passwordless, most organizations like Amazon and even Microsoft still provide the option to use either passwords or other methods to identify yourself such as alternate email addresses, your phone number via text, or even TOTP codes from an authenticator app in their place. Whichever of these make the most sense in a particular situation including your username, possibly password, and then whichever other of the above might be available can still be used in order to bypass or bootstrap yourself back into installing a new passkey on a new phone if that's what is required.

The point is that once you have passkeys on a device like your phone, it's typically easier to just use the passkey instead of your username and password, since even if you're already storing those in a password manager you carry everywhere with you, accessing the passkey from the phone using the multistep process I described above is both more secure (no secret password your friend or even a less potentially secure PC like at a library or Internet Cafe can steal), and really easier than needing to remember the password or go through most of the other steps in order to login.

The reason that added steps like the TOTP code aren't really necessary when using passkeys is because as I've described, the encrypted passkeys are really far more secure to begin with, unphishable or able to be captured in clear text as are those simple 6-digit codes displayed on a screen and typed manually on another.

So, what initially sounds like a rather messy and troublesome process to login on another PC you don't own, since the encrypted passkeys and QR code used to perform it are useless once you've finished and logged out, the worst someone might do is to capture whatever else was displayed on the screen during your website session, like personal banking, Amazon purchasing or other information that you'd probably be unlikely to do somewhere other than from the PC of a friend you really trust or maybe a relative's home.

Hopefully this fills in many of the other holes you've realized exist when using such a complex system, since they're the same sorts of things I learned a few years ago when I started reading about them as they were still being tested by others. Even though I spent over 40 years in a career in computing and the latter half of that as a security professional, passkeys are one of the most complex and difficult to understand items I've had to learn. Like many others in the industry, I've found them to be highly secure, but that makes them similarly difficult for the typical consumer to understand and even to some extent use properly.

If you wish to confirm whether you've already created a passkey for your phone on Amazon, once you're logged in there, go to the Account, Login & Security, Passkey section and if that offers when you click it, it will display where your passkey is stored, in my case Google Password Manager, with Set up: Aug 7th, 2025 displayed below it.

Rob

You're confused about what a passkey is versus a Windows Hello PIN, which is one of many issues we see when consumers try to understand security concepts as complex as passkeys, since the true security in their case is based on public key cryptography, with the private key stored in your device and the public key store on the website you're trying to access.

In other words, the Windows Hello PIN is merely a quick unlock method you use from your personal device, which can also be done using Biometrics like Windows Hello Face (camera) or Fingerprint when either of those physical devices are included with the device, which is becoming more common to make the process easier and faster.

You're correct that the passkeys themselves are associated with each remote website, including login.microsoft.com, which is the primary passkey you actually use when you login to your device using your PIN, since Microsoft stopped using your Microsoft account password to do this quite a few revisions of Windows back, instead storing a passkey for your account and using that when you successfully type your PIN in its place, since that's a much safer method.

The problem you're seeing with your wife using your same "4444" PIN to login to access Amazon, or in truth really the device itself, is actually another common issue which how many people use their Windows Devices today, since you're really logging into Windows itself with a single account, whether that's your own personal Microsoft account like CRobinson@ Microsoft.com or a local account named something else entirely. In this case, you'll need to evolve to using the separate personal Microsoft accounts you already have to login to the device, with each of you having your own initial login to the device(s) you use, with your own personal desktop and other information.

The other possible way to do this is by using your personal smartphones if you each have one to carry your passkeys with you at all times, storing them in an authenticator app on that device and using them both at home and wherever you might be where you want to access your accounts including possibly email, banking, etc. This way, you can still have a single login using a local account at home if you prefer (though Microsoft and I would still recommend using your separate Microsoft personal accounts for this for multiple reasons) along with the ability to 'take your passkeys everywhere', using your smartphone to, for example, access your email or online banking from your device at work if that's allowed, or gain quick access from a friend's home PC when you're visiting if you trust that those devices you're using are otherwise safe for the purpose.

The other point I should make is that Windows 10, which I also use at present, isn't as easy to use with passkeys for several reasons, including that unlike my own Microsoft Surface Go tablet that came with came with Windows Hello Face (and PIN), many older upgraded devices only have the PIN, so they're less easily logged into quickly the now relatively many times daily you'll need to do this. Windows 10 also doesn't have the passkey manager app that Windows 11 does, so troubleshooting or deleting outdated or problematic passkeys there isn't easily possible, making passkeys less friendly when used on those older devices.

For the above reasons, along with an initially flakey set of problems trying to set up my first Amazon passkey login when I didn't understand some of this myself, I've decided to wait until I get a new Windows 11 system to start using passkeys, since the problems I had were mostly due to no visibility and thus no way to troubleshoot with Windows 10.

The other thing that's different when using the smartphone to store and access you passkeys is that instead of using your PC device's keyboard to type your PIN, you'll be using the camera, fingerprint reader and/or PIN on that phone device instead, which if that has at least one Biometric makes that 'cross-device' authentication method relatively easier, though of course your smartphone must be present when needed for that access.

Note that sine the PIN (or Biometric) relates to the device in use and not the passkey itself, those PIN's might be entirely different for both you and your wife just as your stored pictures or fingerprints would obviously be as well, since those are associated with that device in order to 'unlock' both your device and also the passkeys they contain when needed.

Hopefully, this starts to give you an idea how these objects all relate to one another and why people get confused, since the Private keys stored within the TPM (or similar encrypted hardware chip on a smartphone), never actually leave the device itself and are instead used during a challenge/response interaction with the website to create a temporary passkey that's actually what's being sent back and forth during the authentication process, meaning the most critical information stored in your PC or phone device never really leaves, only the public key provided to the website when you first create the account relationship between them and the initial encrypted communication process used to set up the relationship.

See why I stated this system is actually so complex, but once set up with a particular website, as easy to use as simply typing your PIN (or entering your Biometric) into the specific device that contains your passkey, or actually your private key that's used to create it?

It's a truly beautiful and secure system once in place and you understand the basics of how to use it, but without at least some basic understanding of how it flows, its exceedingly difficult to understand, since most people want at least some level of understanding to feel comfortable using it and the invisible private keys, and other highly technical objects flying around between your device(s) and the remote websites are nearly impossible to understand without some form of this description.

Rob