Passkeys
On this page:
How passkeys work
Benefits of passkeys
How to set up a passkey
How to remove a passkey
Device compatibility
Passkeys are a secure way to sign in without a password, and a type of multi-factor authentication.
Your passkey can be used across any linked Australia Post accounts that support passkeys.
How passkeys work
Passkeys use two cryptographic keys: one stored on our server and one stored on your device. The key stored on your device never leaves your device, which helps protect against phishing and credential theft.
When you log in, our server sends a request to your device to prove it has the right key. Your device will ask you to confirm your identity with biometrics (fingerprint, facial recognition), or a device PIN.
There are two types of passkey:
-
Synced passkey: created on a platform (such as iCloud, Google, Windows, 1Password) and synchronised across your devices.
-
Unsynced (or device-bound) passkey: created on your phone, computer, or hardware security device like a YubiKey.
While both types of passkey offer security benefits, synced passkeys can be reused across any devices on which you want to log into MyPost.
Benefits of passkeys
-
Faster login, with no need to remember or enter a password.
-
Passkeys are protected by your device’s built-in security. Using biometrics or a PIN means that only the person who can unlock the device can use the passkey.
-
Passkeys are phishing-resistant because they’re bound to a real website. This means they can’t be entered on a fake website.
-
The cryptographic key stored on your device is hacking-resistant because it never leaves your device.
-
There's no password stored on a server that can be stolen in a data breach.
How to set up a passkey
Before you start, make sure your device and browser are up to date, as some older versions may not support passkeys.
- In your web browser, log into your MyPost account.
- Go to manage account, then login and security.
- In the passkeys section, select manage.
- On the manage passkeys page, select add passkey.
- Follow the steps shown to create your passkey.
Your new passkey will be listed on the manage passkeys page.
You can have up to 20 passkeys across your linked Australia Post accounts.
Recommended: remove your password after setting up a passkey
Once you’ve set up your passkey, we recommend removing your password, for stronger account security. Removing your password means that access to your account is only available with your passkey, which is more secure than a password. Passwords can be guessed or hacked, so keeping one on your account means you don’t get the full security benefit of a passkey.
Before you remove your password, make sure that:
- you have a synced passkey to work across any devices on which you want to use MyPost;
- or if you have unsynced passkeys, make sure one is set up for each device on which you want to use MyPost.
This ensures that you still have a method to log in on all devices, even without a password.
To remove your password:
- In your web browser, log into your MyPost account.
- Go to manage account, then login and security.
- In the password section, select remove.
- When the popup message appears, select remove password to confirm.
How to remove a passkey
- In your web browser, log into your MyPost account.
- Go to manage account, then login and security.
- In the passkeys section, select manage.
- On the manage passkeys page, find the passkey you want to remove. Select remove.
- Select remove passkey to confirm.
You’ll get a confirmation message that your passkey was removed.
To avoid being prompted for your removed passkey when you log in, you should also remove it from your device’s passkey storage. The steps to do this depend on the device you have. Here’s how for Apple, Google and Microsoft Windows:
If you're removing your only passkey, you'll need another method to log in
Before removing your only passkey, add another passkey so you can still log in. If you’re going back to using a password, the next time you log in you’ll need to select Reset password to create a new password.
Device compatibility
To use passkeys, make sure that your device is compatible.
If using your smartphone or tablet, it must be:
- iOS 16 or iPadOS 16 or above
- Android 9 or above
If using a computer, it must be:
- macOS Ventura or above
- Windows 11 or above
- ChromeOS
If using a browser-based passkey, it must be on:
- Google Chrome
- Safari or
- Microsoft Edge
You may also need:
- Bluetooth turned on, if you’re using one device to sign into another.
- a screen lock to create a synced passkey.
- to set up iCloud Keychain if using iOS or macOS.