Passkeys on a Shared or Family Computer

A passkey can feel like a personal key, but on a shared machine it may behave like a house key left in the door. This page shows where the risk actually sits and how to arrange things so convenience does not quietly hand your account to everyone else in the room.

The mistake to avoid first

The most common error is enrolling a passkey into a browser or operating-system profile that other people also use, while treating that credential as if it were private. If the credential is synced — stored in the platform's cloud keychain and carried across your devices — then on many setups anyone who can unlock that browser profile can also use it to sign in. The profile becomes the gate, not your identity.

A passkey does not usually ask "is this really you?" on every sign-in. It asks whether a credential is present and whether the device or profile holding it is unlocked. Separate those two ideas and the risk on a shared machine becomes obvious.

Because behavior differs by platform, verify it yourself rather than trusting a general statement: sign out of the account on the shared profile, then sign back in with the passkey. If it succeeds with no check tied to you personally, then anyone who can use that profile can also get in.

Two ways to separate people on one machine

Separate operating-system user accounts

This is the stronger boundary. Each person signs into their own OS account, and the browser profile, the credential store, and the unlock step all live inside that account. A credential enrolled under your OS account is not reachable from someone else's account while they are logged in as themselves. If a machine is genuinely shared, separate OS accounts are the arrangement that keeps credentials apart.

Separate browser profiles only

A browser profile separates history, bookmarks, cookies, and often the saved-credential store, but every profile still sits inside whichever OS account is logged in. If the other person can reach your OS account — because it has no password, uses a shared password, or has no lock screen — they can switch into your browser profile. Use browser profiles for tidiness and context-switching, not as a security boundary.

On a borrowed or public computer

Treat any machine you do not control as untrusted for credentials.

• Do not sign into your password manager or enable passkey sync on a device you do not own.
• Prefer a credential you physically carry — such as a hardware security key — for accounts that support it, because it does not remain behind when you unplug it and leave.
• If you do sign in on a borrowed machine, sign out fully when finished and clear that browser profile's saved data. Be aware that some platforms are designed to keep a credential in place, so clearing is a habit, not a guarantee.
• Finish the loop later, from your own device: open the account's list of registered passkeys and remove anything you do not recognize. See passkey troubleshooting if removal or sign-in does not behave as expected.

Family setups: one person needs one account

The typical case is a partner, housemate, or child who needs access to a single shared account — a household subscription, a shared inbox, a family calendar — but should not have access to your email, banking, or work logins.

• Keep your personal credentials inside your own OS account and browser profile.
• For the shared account, add the other person as a second user or sub-account where the service offers it; that keeps their access scoped to that service.
• Where no second-user option exists, enroll a separate credential on their device for that one account, so their access does not depend on your profile or your key.
• Do not hand over your whole browser profile to solve a one-account problem. Sharing a profile shares everything inside it.

Choosing per scenario

Scenario	Safe approach	What not to do
One machine, several people, each with their own accounts	Separate OS user accounts; enroll each person's passkeys inside their own account	One shared OS account with one shared browser profile
Your account, briefly used on a family PC	Use a hardware security key you carry; sign out and clear the profile's data afterwards	Leaving a synced passkey in the shared profile
A child or partner needs one shared subscription	Add them as a second user on that service, or enroll a separate credential on their device	Giving them your whole browser profile
Public or borrowed computer	Avoid signing in; if unavoidable, use a credential you carry and sign out fully	Enabling passkey sync on that device
Temporary guest use of your laptop	Create a guest OS account with no access to your profile	Letting a guest use your logged-in OS account

Checking your own setup

Run through this once, on the machine in question, and note what you find. If a shared profile turns out to hold a synced passkey for an important account, the fix is to move that account's credential onto your own OS account or a security key, then remove the shared-profile credential from the account's list. If the only enrolled credential is on a machine you no longer control, the recovery path is covered in passkey backup and recovery and in what to do when the phone is gone. Readers still weighing whether to run a password manager alongside passkeys may find password managers with passkey recovery and passkey vs password manager first useful, with the comparison page for a broader view.

Last updated: 2026-10-16