Windows 11 KB5064081: Windows Hello, Passkeys, and Sign-In Fixes

KB5064081 was the August 29, 2025 non-security preview for Windows 11 24H2, build 26100.5074. Among other changes, it refreshed the Windows Hello interface across sign-in and credential flows. It did not introduce passkeys to Windows for the first time or turn every saved website passkey into a PC-unlock credential. Distinguish your Windows sign-in method from the passkeys used with websites and services before changing security settings.

What changed on the Windows 11 login screen with update KB5064081?

The release notes describe a redesigned Windows Hello interface and clearer switching between credential options, alongside face-recognition and fingerprint reliability fixes. Windows already had native passkey management from Windows 11 22H2 with KB5030310 in 2023. A new-looking prompt is not evidence that the update replaced a password or PIN with a newly enrolled passkey.

The methods offered for Windows sign-in depend on account type, enrollment, hardware, and policy. A Windows Hello PIN or biometric gesture can authorize a Windows sign-in or a website passkey operation, but those are distinct authentication contexts. Installing this preview did not establish a universal rule that Microsoft-account users automatically prioritize passkeys at the lock screen.

How do passkeys work now after installing KB5064081?

A passkey is a public-key credential registered with a supporting website or service. Create it through that service’s account/security flow, choose the available credential provider, and complete the required verification. Windows Hello can protect a locally saved passkey and authorize its use with a PIN, fingerprint, or face recognition. Biometrics are not mandatory for every passkey operation, and a fingerprint itself is not the cryptographic passkey.

For locally saved Windows passkeys, use Settings > Accounts > Passkeys. Other passkeys may be managed by their credential provider or the account’s security dashboard. Settings > Accounts > Sign-in options instead controls Windows Hello and other Windows sign-in configuration; it is not the general saved-website-passkey list.

For example, a supporting website can request a registered passkey and Windows Hello can ask for your fingerprint to authorize the operation. The site verifies a signed challenge using the registered public key. This is different from enrolling a fingerprint to unlock Windows, even when the same sensor and similar-looking prompts are involved.

What to do if you can’t log in or see errors after the update?

Do not assume a lockout is caused by a newly introduced passkey system. Microsoft documented a separate issue after this update in which the password icon could be invisible, mainly in managed environments. The password button’s placeholder could still open the text field. The KB now identifies KB5074105 as the resolution; check current applicable servicing instead of disabling unrelated credentials.

Select Sign-in options and use an available method you have already configured. If you investigate Safe Mode, remember that Windows sign-in there requires the account password: PIN and biometric sign-in are not available. Do not enter Safe Mode expecting a guaranteed passkey-disable workaround. Use recovery instructions for the account type and keep BitLocker recovery access before advanced startup changes.

Use the appropriate Microsoft-account, local-account, or organization-managed recovery flow. A previously created password reset disk applies to a local account, not a Microsoft account. A password reset from another device is not the same as removing a Windows Hello PIN or changing an offline PC’s local credential. For a work or school account, contact the administrator when policy or account access is involved.

Are the passkey changes more secure or risky?

Passkeys use public-key cryptography and bind authentication to the intended service, reducing phishing and shared-password risks when supported and correctly implemented. That benefit is not unique to KB5064081 and should not be described as a new universal PC-login feature from this update.

Protection and recovery depend on the credential provider, device security, account policy, and whether the passkey is device-bound or synced. A broken biometric sensor does not necessarily make a passkey unusable because a supported Windows Hello PIN or another enrolled method may be available. Confirm a working recovery route before deleting credentials.

There’s a small risk that users unfamiliar with passkeys might accidentally lock themselves out or struggle to manage their authentication methods. Overall, passkeys provide stronger protection than passwords but require careful management and fallback options.

Can you customize or disable the new passkey login features?

Review Windows sign-in under Settings > Accounts > Sign-in options and locally saved website/service passkeys under Accounts > Passkeys. Newer builds can expose passkey-provider settings under Passkeys > Advanced options, subject to policy. These settings serve different purposes; there is no single general switch introduced by this preview that simply turns off every kind of passkey-based authentication.

Do not delete saved passkeys merely to change the appearance of the Windows lock screen. Removing a service credential can remove that account’s sign-in route without changing PC-unlock settings. Establish another working method before deletion. If a visual or sign-in fault is documented, apply its supported resolution or current update instead of routinely uninstalling a historical cumulative preview.

Maintain recovery methods supported by your account and organization, and test them before changing credentials. Enrollment of several methods is useful only if those methods are actually permitted and available in the relevant sign-in flow.

Conclusion

Identify which prompt you are seeing: Windows sign-in, a website passkey request, or another credential flow. KB5064081 refreshed the Hello experience; it did not make website passkeys interchangeable with every Windows unlock method. Use the correct settings page, preserve account recovery access, and consult the documented update resolution for a specific fault.

Frequently Asked Questions

What is a passkey in Windows 11 after update KB5064081?

It is a cryptographic credential for a supporting account or service. Windows Hello can authorize use of a locally saved passkey, but that does not mean every website passkey unlocks Windows itself. This capability predates the preview discussed here.

Can I still use my password after installing KB5064081?

The update did not universally remove passwords or PINs. Available Windows sign-in choices depend on account and policy; a documented invisible password-icon issue is separate from a change to the actual credential.

What should I do if I’m locked out after the update?

Use an already configured sign-in method or the appropriate account recovery process. Safe Mode requires the password and is not a general way to disable passkeys. For the documented invisible-icon symptom, follow the update’s resolution guidance above.

Are passkeys safer than passwords?

Generally, yes. Passkeys reduce risks like phishing and password theft by using secure cryptographic authentication instead of shared secrets. However, their security depends on your device’s hardware and proper setup.

How can I turn off passkey login if I don’t want it?

Use Accounts > Passkeys for locally saved service passkeys, or the relevant credential provider/account dashboard for other stored credentials. Use Accounts > Sign-in options for Windows Hello configuration. Removing a saved passkey is not a universal way to turn off PC login prompts; confirm another working account-access method first.