How iOS 18 Passwords Manages Codes and Passkeys

Apple’s dedicated Passwords app in iOS 18 centralizes credential management by integrating two-factor verification codes and next-generation passkeys alongside standard passwords. This article explains how the app generates and autofills time-based one-time passwords (TOTP), securely stores and synchronizes cryptographic passkeys via iCloud Keychain, and streamlines user authentication across Apple devices.

Managing Verification Codes (Two-Factor Authentication)

The iOS 18 Passwords app functions as a native authenticator, eliminating the need for third-party tools like Google Authenticator or Authy.

  • Setup and Generation: When setting up two-factor authentication (2FA) on a supported website or app, users can scan a QR code or paste a setup key directly into the credential's entry within the Passwords app. The app then automatically generates standard 30-second time-based one-time codes (TOTP).
  • Seamless Autofill: When logging in via Safari or supported third-party apps, iOS detects the two-factor prompt and offers to autofill the verification code directly from the keyboard suggestions bar, removing the need to switch apps and copy codes manually.
  • Encrypted Synchronization: Verification codes are synced across all devices connected to the user’s Apple Account using end-to-end encrypted iCloud Keychain. If a code is added on an iPhone, it is instantly available on an iPad, Mac, or Apple Vision Pro.

Managing Passkeys

Passkeys are modern cryptographic credentials built on WebAuthn and FIDO standards, designed to replace traditional passwords with phishing-resistant public-key cryptography.

  • Creation and Storage: When creating a passkey on a supported service, the Passwords app generates a public-private key pair. The private key remains securely stored inside the device's Secure Enclave and iCloud Keychain, while the public key is registered with the website.
  • Dedicated Categorization: The iOS 18 Passwords app includes a dedicated "Passkeys" filter on its main interface, allowing users to quickly view, search, and manage every account secured by a passkey.
  • Biometric Authentication: Logging in with a passkey requires no manual text input. The app uses Face ID or Touch ID to verify the user’s identity and sign the cryptographic challenge.
  • Cross-Platform Access: While passkeys sync seamlessly across Apple devices via iCloud Keychain, the Passwords app also allows users to log into non-Apple devices (such as Windows or Android). By scanning an on-screen QR code with an iPhone camera, the iOS Passwords app safely verifies the login request over a secure Bluetooth-assisted connection.

Security and Recovery

Both verification codes and passkeys within the iOS 18 Passwords app benefit from Apple's robust security architecture. All data is protected with end-to-end encryption, ensuring that only the user with access to their trusted devices and passcodes can view or decrypt credentials. Additionally, users can share specific passkeys and verification codes securely with trusted contacts using the Shared Groups feature, maintaining full control over credential access.