Windows Hello is usually not the passkey itself. It is the local PIN, fingerprint, face scan, or security-key step that approves a passkey stored on your device or in your password manager. Get that wrong, and you can mix up sign-in paths, waste time on the wrong fix, or choose the wrong setup step. This guide explains where Windows Hello fits, how passkeys work on Windows, and what to check when a site asks you to sign in.
What passkeys are and how Windows Hello fits
Passkeys are a passwordless sign-in method built on a public-key/private-key pair and the WebAuthn standard. The private key stays on a device, in a synced credential manager, or on a security key, and the site or app gets proof without seeing your password. Windows Hello is usually the local user-verification step that approves that proof on a Windows device.
On Windows 10 and Windows 11, Windows Hello can use face recognition, fingerprint recognition, or a PIN. Face sign-in needs a Hello-compatible camera. Fingerprint sign-in needs a fingerprint reader. Microsoft also says passkeys can be used with Windows Hello using PIN, fingerprint, or face. (Microsoft Support) (Microsoft Support)
What “Windows Hello passkey” means
In Microsoft flows, “Windows Hello passkey” usually means a passkey saved on the Windows device and approved by Windows Hello. That is different from Windows Hello being the credential itself. The credential is the passkey; Windows Hello is the step that verifies it locally.
📊 Windows Hello is available on Windows 10 and Windows 11. Source: Microsoft.
What you'll need
- A Windows 10 or Windows 11 device with Windows Hello available.
- An IR camera for face sign-in, or a fingerprint reader for fingerprint sign-in.
- A PIN set up for Windows Hello, if you do not use face or fingerprint.
- A passkey-capable Microsoft account, work or school account, or website.
- Microsoft Password Manager if you want a synced save location.
- A security key if you want a hardware-only passkey option.
How Windows Hello is used as the verification step for passkeys
When a site or Microsoft account asks for a passkey, Windows Hello can approve the request with face, fingerprint, or PIN. The biometric data is generally kept on the device and is not typically shared with Microsoft. The site gets the passkey proof it needs, but it does not get your face scan or fingerprint data.
A common first-timer mistake is thinking the biometric scan is the passkey. It is not. The scan only approves the local credential flow.
How to tell what you are signing
If the screen is asking for a Windows sign-in after you lock your PC, that is local Windows login. If a browser or app opens a passkey sheet for a website or Microsoft account, that is a passkey prompt. If the prompt offers face, fingerprint, or PIN, Windows Hello is usually the verifier behind the scenes.
Say your Windows 11 laptop shows a prompt while signing in to a bank site in Edge. If the prompt asks for face or PIN, you are approving a passkey request. If the same device asks for a PIN at the lock screen, that is still Windows Hello, but it is for device sign-in rather than a website credential.
Save a passkey on Windows
To create a passkey, start from the account or website that offers passkey setup. The prompt usually asks where to save it. On Windows, the main choices are the Windows device, Microsoft Password Manager, or a security key.
- Open the account or website sign-in page and choose the option to create or save a passkey.
- Select the save location shown on screen: Windows device, Microsoft Password Manager, or security key.
- Complete the Windows Hello check with face, fingerprint, or PIN if the device prompts for it.
- Finish the site or account confirmation screen and keep the passkey on the chosen location.
- If the site offers sync, confirm that the credential manager or account you chose is the one you want to use later.
Choose Windows device if you want a passkey tied to that PC. Choose Microsoft Password Manager if you want a synced credential manager. Choose a security key if you want the credential on a physical hardware token.
What the on-screen prompts usually ask
Microsoft account flows can show Face, Fingerprint, PIN, or Security Key as sign-in methods for a personal account. If Windows Hello is enrolled, the prompt may use it as the local approval step. If it is not available, the site may offer another method or stop and ask you to set one up first.
Windows Hello passkey decision table
Use this table to separate the credential from the verification step. The key question is simple: is Windows Hello the passkey, or is it just approving a passkey stored somewhere else?
| Scenario | Is Windows Hello the passkey? | What Windows Hello is doing | Where the passkey is stored | What you will see on screen |
|---|---|---|---|---|
| Local Windows login | No | It is the device unlock method | No passkey is involved | Face, fingerprint, or PIN sign-in for the PC |
| Microsoft account sign-in | Usually no | It approves the passkey or another credential | Windows device, Microsoft Password Manager, or security key | A Microsoft sign-in prompt with passkey or Hello verification |
| Third-party website sign-in | No | It verifies the request on the device | Windows device, password manager, phone/tablet, or security key | A browser passkey prompt, then face, fingerprint, or PIN |
| Work or school account | Usually no | It may approve a passkey if policy allows it | Depends on organization support and limits | A managed sign-in prompt or a blocked setup screen |
| Synced passkey across devices | No | It approves the local copy on this Windows PC | Synced credential manager such as Microsoft Password Manager | Sign-in works on multiple devices after sync |
| Security-key-only setup | No | It is not used, unless the site also offers Hello | Security key | Security-key prompt, often with a physical touch or insert step |
What can block Windows Hello or passkeys?
The most common blocker is missing enrollment. If face or fingerprint was never set up, Windows Hello cannot approve a passkey prompt for that method. Hardware matters too: face sign-in needs a Hello-compatible camera, and fingerprint sign-in needs a fingerprint reader.
Work or school devices add another layer. Microsoft says work or school passkeys depend on organizational support and limits. That means an admin can restrict whether a passkey can be created, saved, or used on a managed PC. (Microsoft Support)
- Open Settings > Accounts > Sign-in options and confirm Windows Hello is set up on the device.
- Check whether your camera or fingerprint reader is present and enabled in Device Manager if Hello does not appear.
- On a managed device, sign in with your work or school account and check the organization’s sign-in policy screen if passkey setup is blocked.
- If the prompt falls back to PIN, use the PIN to finish the sign-in and then re-check whether face or fingerprint is enrolled.
Suppose a laptop has no fingerprint reader and the face camera is disabled. In that case, a passkey prompt may still work with PIN if the account allows it. If the organization blocks that path, the prompt can stop and require a different approved method.
Does Windows Hello for Business use passkeys?
Windows Hello for Business can sit next to passkey workflows, but it is not the same thing as a consumer passkey. In work environments, the available sign-in path depends on organizational policy, device enrollment, and whether the account is allowed to use a passkey at all. The deciding factor is admin control, not the label on the prompt.
For a personal Windows device, the simpler rule usually holds: Hello verifies you locally, and the passkey lives in the place you chose. For a work or school account, ask whether the organization permits passkeys on that device before you assume the flow will behave like a personal Microsoft account.
Can I use passkeys with Windows Hello on Windows 11?
Yes. Windows 11 supports passkey use with Windows Hello, and Microsoft says passkeys can be approved with PIN, fingerprint, or face. In newer Windows 11 builds, passkey management is integrated into Settings > Accounts > Passkeys, where you can manage and delete saved passkeys.
That screen matters because it gives you a native place to check what is stored on the device. If a passkey was saved to the Windows device, it should appear there. If it was saved to Microsoft Password Manager or a security key, the storage location will be different.
Where are Windows Hello passkeys stored?
They are not stored “in Windows Hello” as a standalone vault. The passkey can be saved on a Windows device, in Microsoft Password Manager, on another device, or on a security key. Windows Hello is the local approval step when the passkey lives on the PC or is being used there.
Should I use Windows Hello?
Yes, if you want a fast local sign-in method on a Windows 10 or Windows 11 PC and you have the right hardware. Windows Hello is a good fit when you want face, fingerprint, or PIN access on the device itself, and you also want to approve passkey prompts without typing a password every time.
If you need your sign-in credential to move across multiple devices, Windows Hello by itself is not enough. In that case, use a synced credential manager such as Microsoft Password Manager or a security key, then use Windows Hello on the Windows device to approve the sign-in when prompted.
Frequently asked questions
Does Windows Hello use passkeys?
Usually no. Windows Hello is the local verification step, while the passkey is the credential stored on the device, in Microsoft Password Manager, or on a security key. Windows Hello can approve the passkey request with face, fingerprint, or PIN, but it is not the passkey itself.
Is Windows Hello the same as a passkey?
No. A passkey is a public-key credential used by WebAuthn. Windows Hello is the local method used to verify the person using the device. If you see a face or PIN prompt while signing in, Hello is approving the passkey, not replacing it.
Can my organization restrict Windows Hello passkeys?
Yes. Microsoft says work or school passkeys depend on organizational support and limits. On a managed device, an admin can restrict whether a passkey can be created or used. If setup is blocked, check the organization’s sign-in policy and the device’s account settings.
Do passkeys sync across Windows devices?
They can, if you save them in a synced credential manager such as Microsoft Password Manager. A passkey saved only on one Windows device generally stays there unless you move or sync it through a supported manager. A security key also keeps the credential on the hardware token.
Can I sign in with a passkey using face, fingerprint, or PIN?
Yes. Microsoft says passkeys can be used with Windows Hello using PIN, fingerprint, or face. The exact method depends on what is enrolled on the device. If face or fingerprint is unavailable, the prompt may fall back to PIN if the account and policy allow it.