If you’ve been searching for a reliable windows 11 passkeys setup method that doesn’t force you into signing in with a Microsoft account, the 25H2 update finally makes this practical for everyone. Passkeys are the new industry standard for passwordless login Windows 11 users have been waiting for, and Microsoft has expanded native support across local accounts, work profiles, and third-party managers. In this guide, we’ll walk through exactly how to create, use, and manage passkeys on Windows 11 25H2 — even if you prefer a local account for privacy or IT reasons. Everything below is tested, practical, and focused on real-world results.
What Passkeys Are and Why They Matter in Windows 11 25H2
A passkey is a cryptographic credential that replaces the traditional username-and-password combination with a public/private key pair. The private key never leaves your device, while the public key is stored on the service you’re logging into. When you authenticate, your device signs a challenge with your private key, and the service verifies it — no shared secret ever traverses the internet.
Windows 11 25H2 brings deeper integration for the FIDO2 Windows 11 standard, including a redesigned passkey manager, plugin support for third-party credential providers like 1Password, Bitwarden, and Dashlane, and better cross-device authentication via QR codes. This means you can now use passkeys almost anywhere on the web and in supported apps.
Crucially for privacy-conscious users, 25H2 no longer requires a Microsoft account to store or use passkeys locally. Your credentials can live entirely on your device, protected by Windows Hello biometrics or a hardware security key. This is a major shift from earlier Windows builds where cloud sync effectively required a Microsoft sign-in.
Key Benefits of Going Passwordless
- Immune to phishing — passkeys are bound to the domain that created them
- No credential reuse across sites, eliminating one of the biggest breach vectors
- Faster sign-in with a fingerprint, face scan, or PIN
- Works offline once the passkey is created
- Compatible with the FIDO Alliance standard across Apple, Google, and Microsoft ecosystems
Prerequisites Before You Start
Before diving into the windows 11 25h2 security configuration, you’ll want to make sure your system is ready. Passkeys rely on a Trusted Platform Module (TPM 2.0) and Windows Hello for the strongest protection, though FIDO2 security keys work as a fallback on older hardware.
- Confirm you’re running Windows 11 version 25H2 — open Settings and go to System > About to check.
- Verify TPM 2.0 is enabled by pressing Win + R, typing
tpm.msc, and pressing Enter. - Set up Windows Hello (PIN at minimum, fingerprint or face if your hardware supports it) under Settings > Accounts > Sign-in options.
- Update Microsoft Edge, Chrome, or Firefox to the latest version — passkey ceremonies happen in the browser layer.
- Optional: have a FIDO2-certified hardware key (YubiKey, Google Titan, etc.) if you want portable authentication.
Pro tip: If Windows Hello won’t set up because you’re on a local account, don’t worry — 25H2 explicitly supports Hello with local accounts. If the option is greyed out, run Windows Update again; Microsoft pushed a fix for this in the August 2026 cumulative patch.
Setting Up a Passkey Without a Microsoft Account
Here’s the core workflow for creating a passkey without Microsoft account involvement. This uses your local Windows account and the built-in Windows Hello authenticator, which is exactly what most privacy-minded users want.
- Sign into Windows using your local account. If you’re currently signed in with a Microsoft account, go to Settings > Accounts > Your info and choose “Sign in with a local account instead.”
- Open Settings > Accounts > Passkeys. In 25H2, this menu now lists every passkey stored on your device.
- Choose your default passkey provider. To keep everything local, select Windows Hello. To use a third-party manager, pick it from the dropdown (it must be installed first).
- Open a browser and navigate to a site that supports passkeys — good examples include Google, GitHub, PayPal, eBay, and Amazon.
- Go to that site’s security settings and choose “Add a passkey” or “Set up passkey.”
- When the Windows prompt appears, confirm you want to save the passkey to This Windows device, then authenticate with your PIN, fingerprint, or face.
- The passkey is now stored locally, tied to your TPM, and ready for future sign-ins.
You’ll notice Windows never asked for a Microsoft account during that process. The passkey lives on your machine and is unlocked by Windows Hello. This is the cleanest setup for anyone who prefers local-only credentials.
Using a FIDO2 Hardware Key Instead
If you’d rather store passkeys on a physical security key — useful for shared or high-security machines — the process is nearly identical:
- Insert your FIDO2 key into a USB port (or tap it via NFC on supported devices).
- When the passkey creation prompt appears, choose Security key instead of “This Windows device.”
- Set a PIN for the key if you haven’t already, then touch the key’s button to confirm.
- Windows will store a reference to the credential, but the actual private key stays on the hardware.
Warning: Always register at least two hardware keys per account. If you lose your only key, recovery can be painful — some services require you to fall back to email or SMS verification, which defeats much of the security benefit.
Managing and Using Passkeys Day to Day
Once passkeys are set up, using them is remarkably smooth. When you visit a site where you’ve saved a passkey, the browser detects it and offers to sign you in with Windows Hello passkeys. You authenticate with a biometric or PIN, and you’re in — usually within two seconds.
The new passkey manager in 25H2 (found under Settings > Accounts > Passkeys) shows every credential on your device, grouped by website. You can search, rename, or delete individual passkeys. This is a huge upgrade from 24H2, where you had to hunt through browser settings to find them.
For a deeper dive into making passkeys your primary sign-in method across the OS, our companion tutorial on setting passkeys as the default login on Windows 11 in 2026 walks through the group policy tweaks and registry entries that force passkey-first authentication.
Cross-Device Sign-In With QR Codes
Sometimes you’ll need to sign into a website on Windows using a passkey stored on your phone. Windows 11 25H2 handles this via the FIDO2 hybrid transport protocol:
- On the login page, choose “Use a passkey from another device”
- Scan the displayed QR code with your iPhone or Android camera
- Approve the request on your phone using Face ID, Touch ID, or fingerprint
- Windows uses Bluetooth proximity to confirm the two devices are near each other, then completes the sign-in
This works even if your phone runs iOS — a nice touch for mixed-ecosystem households. Speaking of iOS, if you’re managing Apple devices alongside Windows and running into odd behaviour, our Apple Intelligence troubleshooting guide covers a lot of related authentication and sync gotchas.
Troubleshooting Common Passkey Problems
Even with 25H2’s improvements, users run into a handful of recurring issues. Here are the most common ones and how to resolve them quickly.
Windows Hello prompt never appears: This usually means your browser is out of date or the site is falling back to WebAuthn’s older API. Update the browser, and if the problem persists, clear the site’s cached credentials and try again.
Passkey creation fails with “platform authenticator unavailable”: Your TPM might be disabled in firmware. Reboot into UEFI/BIOS, enable TPM (sometimes labelled “PTT” on Intel or “fTPM” on AMD), and try again.
Cannot select Windows Hello as provider: Go to Settings > Accounts > Sign-in options and make sure you have a PIN configured. Passkeys require a PIN even when biometrics are set up, because the PIN is the ultimate fallback.
Third-party manager not showing up: After installing an app like Bitwarden, you must explicitly enable it under Settings > Accounts > Passkeys > Additional providers. Windows won’t auto-enable third-party providers for security reasons.
When to Reset the Passkey Database
If you’re seeing repeated failures or ghost entries in the passkey manager, resetting the local credential store can help. Open PowerShell as administrator and run:
certutil -deletestore -user MY "WindowsHelloForBusiness"— this clears Hello certificates- Restart your PC
- Re-register Windows Hello under Sign-in options
- Recreate any passkeys on the affected sites
Warning: This will invalidate every passkey stored via Windows Hello on that device. Only do it as a last resort, and make sure you still have password fallback access to your accounts before running the command.
Advanced Tips for Power Users
Once you’ve got the basics working, there are several optimisations worth applying. First, consider using a dedicated password manager as your passkey provider even on a local account — this gives you sync across Windows, macOS, iOS, and Android without any Microsoft cloud involvement. Bitwarden and 1Password both integrate cleanly with Windows 11 25H2’s provider framework.
Second, if you use a Mac alongside your Windows PC, tools like the ones covered in our Raycast launcher review can bridge productivity workflows, though passkeys themselves sync through your chosen manager, not the launcher.
Third, audit your passkey inventory monthly. Open the passkey manager and delete anything you no longer recognise or use — old test accounts, abandoned services, or duplicates. A lean credential store reduces attack surface and makes troubleshooting easier.
Finally, keep an eye on Microsoft’s insider builds. Features like passkey export/import (currently in preview) will make migrating between devices far smoother once they ship to stable. For broader tech news and guides beyond Windows, Hawkdive’s main tips section covers Android, iOS, and macOS workflows that pair well with a passkey-first Windows setup.
Frequently Asked Questions
Can I use passkeys on Windows 11 without a Microsoft account?
Yes. Windows 11 25H2 fully supports passkey creation and use on local accounts. Windows Hello (PIN plus optional biometrics) acts as the authenticator, and your passkeys are stored locally on the device’s TPM. No Microsoft account, no cloud sync, and no telemetry sign-in are required for the passkey system to function.
Are passkeys safer than passwords in Windows 11?
Significantly safer. Passkeys are resistant to phishing because they’re cryptographically bound to the exact domain that created them — a lookalike site cannot trick your device into signing a challenge. They also can’t be reused across services, aren’t stored on remote servers as hashable secrets, and require local biometric or PIN confirmation to use. The combination eliminates the most common attack vectors against traditional passwords.
How do I sync passkeys across Windows devices?
Without a Microsoft account, Windows won’t sync passkeys natively between machines. The workaround is to use a third-party passkey provider like Bitwarden, 1Password, or Dashlane as your default provider under Settings > Accounts > Passkeys. These managers sync your credentials through their own encrypted cloud, giving you access on every device you sign into.
Which apps support passkeys on Windows 11 25H2?
Web support is broad: Google, Microsoft, Apple ID, Amazon, eBay, PayPal, GitHub, GitLab, Best Buy, Adobe, Nintendo, Shopify, and hundreds of others accept passkeys. Native Windows app support is still growing, but Microsoft 365, GitHub Desktop, and Discord’s beta client all now use the WebAuthn platform authenticator. Expect this list to expand rapidly through 2026.
How do I remove a passkey from Windows 11?
Open Settings > Accounts > Passkeys, locate the entry you want to remove, click the three-dot menu next to it, and choose Delete. You should also remove the corresponding credential from the website’s security settings, otherwise the site will still expect a passkey login and you’ll need to fall back to another sign-in method.
Final Thoughts
A well-executed windows 11 passkeys setup transforms how you interact with the web — faster sign-ins, dramatically better security, and no more password fatigue. The 25H2 update finally makes this accessible without forcing you into the Microsoft account ecosystem, which is a huge win for anyone who values local control over their credentials. Take fifteen minutes today to set up Windows Hello, enable your favourite passkey manager, and migrate your top five most-used accounts. You’ll wonder why you waited.
Ready to go deeper? Follow up with our guide on making passkeys your default Windows 11 login to lock in a truly passwordless workflow, or explore hidden iOS 27 features if you want to align your iPhone’s authentication settings with your new Windows setup for a seamless cross-device experience.
