---
url: 'https://www.corbado.com/blog/use-windows-11-without-windows-hello-microsoft-account'
title: 'Use Windows 11 Without Windows Hello / Microsoft Account'
description: 'Learn how passkey-ready Windows 11 is and if it works without Windows Hello or a Microsoft account for passkey authentication.'
lang: 'en'
author: 'Vincent Delitz'
date: '2024-10-21T11:19:59.730Z'
lastModified: '2026-09-08T06:01:16.043Z'
keywords: 'Microsoft account, without windows hello'
category: 'Authentication'
---

# Use Windows 11 Without Windows Hello / Microsoft Account

## Key Facts

- **99% of Windows 11 users** with a Microsoft account have Windows Hello activated,
  meaning the vast majority of Windows 11 devices are passkey-ready.
- Without **Windows Hello**, Windows 11 blocks local platform authentication for passkeys
  but still allows cross-device authentication via QR codes, Bluetooth and hardware
  security keys.
- Calling **`isUserVerifyingPlatformAuthenticatorAvailable()`** on Windows 11 detects
  Windows Hello status with 100% certainty, letting developers trigger proper fallback
  authentication when needed.
- **Google Password Manager** in Chrome enables passkey use on Windows 11 without Windows
  Hello or a Microsoft account, requiring only a six-digit recovery PIN.
- **Passkey syncing via Microsoft accounts** is expected in Q1 2025, which may change how
  local Windows 11 accounts interact with passkeys across devices.

## 1. Introduction

As passkeys become the prevalent form of authentication, developers and product managers
are increasingly interested in how [Windows 11](https://www.corbado.com/blog/passkeys-windows-11) devices handle
passkeys, especially when [Windows Hello](https://www.corbado.com/glossary/windows-hello) or a Microsoft account
is not in use. Therefore, in this article, we will explore three key questions:

1. **How passkey-ready is Windows 11?**
2. **Can you use Windows 11 without a Microsoft account?**
3. **Can you use Windows 11 without Windows Hello?**

Understanding these configurations will give developers and product managers better
insights into how passkeys behave in environments with different setups.

## 2. What is Windows Hello?

See this FAQ to understand better what [Windows Hello](https://www.corbado.com/glossary/windows-hello) is.

## 3. What is a Microsoft Account?

A Microsoft account is a single sign-in credential used to access various Microsoft
services, such as Windows, Outlook, OneDrive, Office 365, and Xbox. By using a Microsoft
account, users can synchronize their files, preferences, and settings across multiple
devices and access cloud storage. This unification creates a seamless user experience,
whether on a PC, smartphone, or tablet.

The integration of Microsoft accounts with [Windows 11](https://www.corbado.com/blog/passkeys-windows-11)
improves the security and user experience. However, not all users prefer to use a
Microsoft account and may choose to use a local account instead.

## 4. How Many Users Have Windows Hello Activated?

[Windows Hello](https://www.corbado.com/glossary/windows-hello) is a feature in Windows designed to enhance
security by offering [biometric authentication](https://www.corbado.com/blog/passkeys-biometric-authentication),
such as facial recognition or fingerprint scanning, or also PIN codes. Microsoft has been
actively pushing users to adopt Windows Hello by integrating it with various security
features and requiring it for certain functionalities.

Additionally, the use of Microsoft accounts is encouraged and
[for some Windows versions even required](https://www.theverge.com/2022/2/18/22940517/windows-11-pro-require-microsoft-account-internet-connection),
as it allows users to sync settings, preferences, and apps across devices (passkeys will
soon also be synced via Microsoft accounts, presumably as of Q1/2025 according to
Microsoft-internal resources).

Let’s look at two interesting follow-on questions then:

1. **How many Windows 11 users have a Microsoft account?**
2. **How many Windows 11 users have Windows Hello activated?**

Although there is limited specific data on how many
[Windows 11](https://www.corbado.com/blog/passkeys-windows-11) users have a Microsoft account activated.
Microsoft has shifted its focus to promoting passwordless security options, including
passkeys, as the of the new standard of authentication. This conclusion is also backed by
the following data that Microsoft recently published and it makes clear that the vast
majority of users has Windows Hello activated:

![microsoft account windows hello passkeys data](https://www.corbado.com/website-assets/microsoft_account_windows_hello_passkeys_data_7377dae4c7.png)

## 5. Can You Use Windows 11 Without a Microsoft Account?

Yes, it is possible to use Windows 11 without a Microsoft account, though Microsoft has
made this process less straightforward over time. During the Windows 11 installation,
users can opt for a local account by selecting "I don’t have internet" or "Skip for now"
when prompted to connect to a network. This allows them to create a local user account
instead of linking the device to a Microsoft account.

However, this method may not work on all versions of Windows 11, as some might force users
to connect to the internet and create a Microsoft account. Additionally, users with local
accounts may find that some services and apps are unavailable or limited in functionality.

To set up Windows 11 without a Microsoft account, look for the various tutorials you find
on the Internet.

## 6. Can a Local Windows Account Have Windows Hello Activated?

Yes, at the timing of writing this article a local Windows 11 account can have Windows
Hello activated (October 2024). This means that users can still benefit from biometric
authentication, such as facial recognition or fingerprint scanning, without needing a
Microsoft account. In this setup, the passkeys would be device-bound.

However, it’s worth noting that in Q1 2025, Microsoft is expected to allow passkey syncing
across devices, which could change how local accounts interact with passkeys.

## 7. How About Windows 10 Requirements for Windows Hello / Microsoft Account?

Windows 10 handles Windows Hello and Microsoft accounts differently from Windows 11. One
of the key differences is that **Windows 10 does not require a Trusted Platform Module
(TPM) to be installed.** In case a hardware TPM is not available, Windows 10 emulates a
TPM via software.

However, Microsoft has still been encouraging users to adopt both **Windows Hello** and
**Microsoft accounts** on Windows 10. The push comes from a desire to improve security and
convenience. Windows Hello offers enhanced protection against
[phishing](https://www.corbado.com/glossary/phishing) attacks, and Microsoft accounts enable seamless syncing of
settings, files, and services across devices.

## 8. What’s the Passkey Behavior Without Windows Hello?

First of all, Windows 11 has really good detection capabilities for passkey-readiness. By
calling `PublicKeyCredential. isUserVerifyingPlatformAuthenticatorAvailable()`, you can
determine with 100% certainty if Windows Hello (local
[authenticator](https://www.corbado.com/glossary/authenticator)) is active or not. Thus, based on this
information, fallback authentication can be directly used if Windows Hello is not
available making sure the UX is always great.

We ran tests using a local Windows 11 account, with Windows Hello turned off, and
attempted to check the passkey-readiness of the device on
[state-of-passkeys.io](https://state-of-passkeys.io).

When trying to use passkeys without Windows Hello enabled, a prompt appeared, requesting
that Windows Hello should be activated to proceed with the passkey setup. This might
indicate that, in some cases, Windows Hello is required to use passkeys, particularly for
local platform authentication.

![windows 11 edge turn on windows hello](https://www.corbado.com/website-assets/windows_11_edge_turn_on_windows_hello_f56c773c33.png)

When testing for passkey-sync-readiness on
[State of Passkeys](https://state-of-passkeys.io):

![test passkey readiness turn on windows hello](https://www.corbado.com/website-assets/test_passkey_readiness_turn_on_windows_hello_b0b55ef97e.png)

The popup above only occurs if fallbacks are not handled properly (e.g. in Corbado’s UI
components, we fall back directly to email OTP when passkey-readiness is not given, thus
avoiding user confusion).

As most users have Windows Hello activated anyways, only a tiny fraction of users should
this popup.

When clicking on **Close**, the final result was the following:

![no windows hello passkey readiness](https://www.corbado.com/website-assets/no_windows_hello_passkey_readiness_808a64289c.png)

You might ask yourself why is the device not **Passkey-ready** but
**Conditional-UI-ready**. This is partially due to the definitions of
[State of Passkeys](https://state-of-passkeys.io) because passkey-ready could be also
described as Platform-Auth-Ready which indicates if a local
[platform authenticator](https://www.corbado.com/glossary/platform-authenticator) is available. As Windows Hello
is not activated, the local [authenticator](https://www.corbado.com/glossary/authenticator) check is false.
However, it’s possible to use
[cross-device authentication](https://www.corbado.com/blog/proximity-exchange-protocol-pxp) (via
[QR code](https://www.corbado.com/blog/qr-code-login-authentication) and Bluetooth) as well as synced passkeys
from [Google Password Manager](https://www.corbado.com/blog/how-to-use-google-password-manager) via
[Conditional UI](https://www.corbado.com/glossary/conditional-ui). That’s why the device signals
Conditional-UI-readiness.

How the system then handles the user login flow depends a lot on the implementation. A
default test on [https://webauthn.io](https://webauthn.io) resulted in the following
screenshot when Windows Hello was not activated:

![no windows hello popup default](https://www.corbado.com/website-assets/no_windows_hello_popup_default_095655a0a1.png)

This means, that WebAuthn
[cross-device authentication](https://www.corbado.com/blog/proximity-exchange-protocol-pxp) (via QR codes and
Bluetooth) was possible as well as
[hardware security keys](https://www.corbado.com/blog/best-fido2-hardware-security-keys), even without Windows
Hello.

Other systems might directly fall back to their fallback login methods (e.g. password,
email OTP) and avoid this popup.

## 9. How Does Google Password Manager Sync Change Passkey Behavior?

When logging into a Google profile on Chrome, the
[Google Password Manager](https://www.corbado.com/blog/how-to-use-google-password-manager)’s cross-platform sync
feature comes into play (Google Password Manager behaves here like a third-party
[password manager](https://www.corbado.com/blog/passkeys-vs-password-managers) such as
[1Password](https://www.corbado.com/blog/1password-passkeys-best-practices-analysis) or
[Dashlane](https://www.corbado.com/blog/dashlane-passkeys)). This allows users to log in with passkeys on a
Windows 11 device without needing to activate Windows Hello or connect to a Microsoft
account. An initial verification and a six-digit recovery code were required (sometimes
it’s also the [Android](https://www.corbado.com/blog/how-to-enable-passkeys-android) PIN pattern if an
[Android](https://www.corbado.com/blog/how-to-enable-passkeys-android) device is connected), but after that, the
login process felt seamless – almost magical.

In Chrome, when logged in to your Google profile and you want to use the passkeys stored
in [Google Password Manager](https://www.corbado.com/blog/how-to-use-google-password-manager), the following
popup appears initially. You then provide a six-digit recovery PIN.

![windows chrome use passkey google password manager](https://www.corbado.com/website-assets/windows_chrome_use_passkey_google_password_manager_bc3ced455b.png)

This recovery PIN is also being asked for when you want to use /
[create a passkey](https://www.corbado.com/blog/passkey-creation-best-practices) later. So, let’s create passkey
in Google Password Manager:

![windows chrome create passkey google password manager](https://www.corbado.com/website-assets/windows_chrome_create_passkey_google_password_manager_205694f6e3.png)

Provide the recovery PIN.

![windows chrome passkey enter recovery pin google password manager](https://www.corbado.com/website-assets/windows_chrome_passkey_enter_recovery_pin_google_password_manager_7dfe264259.png)

If a passkey is successfully stored in Google Password Manager on Windows 11 without
Windows Hello or an activated Microsoft account, you will see the following popup below
the browser’s URL field.

![windows chrome passkey saved in google password manager popup](https://www.corbado.com/website-assets/windows_chrome_passkey_saved_in_google_password_manager_popup_8a241a88fc.png)

When doing this verification and setting a six-digit recovery code for this device you can
login with passkeys on a Windows 11 device without setting up Windows Hello or having a
Microsoft account.

If you’re logged into your Google profile in Chrome on Windows 11, you now have also the
possibility to save passkeys via **Save another way**. Then, the following options appear
(Google Password Manager and Windows Hello).

![windows chrome passkey provider selection](https://www.corbado.com/website-assets/windows_chrome_passkey_provider_selection_850d85cc4e.png)

However, when Windows Hello is not turned on and you click on this option, then the
following popup comes again:

![windows chrome turn on windows hello](https://www.corbado.com/website-assets/windows_chrome_turn_on_windows_hello_25721727bb.png)

## 10. How Corbado can help

The test above shows a Windows 11 machine reporting
`isUserVerifyingPlatformAuthenticatorAvailable()` as false while
[conditional mediation](https://www.corbado.com/blog/webauthn-conditional-ui-passkeys-autofill) is still
available. That combination is the whole problem. It is invisible from your server, it
changes the moment the user signs into a Chrome profile, and the experience the user gets
depends entirely on which fallback your login picks.

[Corbado Observe](https://www.corbado.com/observe), the
[authentication observability](https://www.corbado.com/blog/authentication-observability) layer, sizes that state
on the browsers that actually reach your login. Its
[Client Capabilities](https://www.corbado.com/blog/webauthn-client-capabilities) view charts platform
[authenticator](https://www.corbado.com/glossary/authenticator) availability, the
`isUserVerifyingPlatformAuthenticatorAvailable()` result, as a share of login sessions
over time, and the chart filters by operating system. "What share of my Windows sessions
has no [platform authenticator](https://www.corbado.com/glossary/platform-authenticator), and is that share
moving" stops being a guess and becomes a line you can watch.

[Video: Device health](https://www.corbado.com/videos/features/device-health.mp4) ([See how Corbado Connect ships this](https://www.corbado.com/connect))

- **Device Health** groups ceremonies by OS, OS version and device model and reports
  completion rate, incomplete ceremonies and duration for each group. A Windows build
  where [passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) keeps stalling on the
  Hello prompt stands out from the rest of your traffic.
- **Passkey Errors** attributes the failures to a reason, which separates a user who
  closed the Windows Hello dialog from a device that cannot create a platform credential
  at all.
- **Passkey Insights** groups the credentials your users already have by authenticator,
  transport and sync status. That is how you see what share of your Windows base keeps its
  [passkeys in Google](https://www.corbado.com/blog/google-passkeys)
  [Password Manager](https://www.corbado.com/blog/passkeys-vs-password-managers) instead of Windows Hello, the
  behaviour section 9 describes.
- **User Search** is where the exact pairing from the test above is recorded for one
  person. The client environment of a single flow lists "Built-in authenticator" (the
  `isUvpaa` result) and
  "[Passkey autofill](https://www.corbado.com/blog/webauthn-conditional-ui-passkeys-autofill)" (the
  `isConditionalMediationAvailable()` result) next to each other, so a ticket that reads
  "the sign-in button did nothing" gets answered from the state that machine was in rather
  than from a reproduction attempt on someone else's laptop.

## 11. Conclusion

In summary, most Windows 11 users can seamlessly use passkeys as the vast majority of
Windows 11 users have a Microsoft account and use Windows Hello. While Windows 11 is
optimized for users with a Microsoft account and Windows Hello activated, it is still
possible to use the operating system - and passkeys - without them. Let’s look at our
questions from the beginning:

1. **How passkey-ready is Windows 11?** Most Windows 11 devices use a Microsoft account
   and 99% of these have Windows Hello activated. As Windows Hello indicates
   passkey-readiness, the vast majority of Windows 11 devices are ready for passkey usage.
2. **Can you use Windows 11 without a Microsoft account?**\
   Yes, you can use Windows 11 without a Microsoft account by opting for a local account
   during installation. However, this setup may limit access to certain apps and services,
   and the process is not available on all versions of Windows 11.
3. **Can you use Windows 11 without Windows Hello?**\
   Yes, you can use Windows 11 without enabling Windows Hello. However, if you want to use
   passkeys, Windows Hello is often required to enable local platform authentication.
   Without Windows Hello, you can still use WebAuthn
   [cross-device authentication](https://www.corbado.com/blog/proximity-exchange-protocol-pxp) (via QR codes or
   Bluetooth), [hardware security keys](https://www.corbado.com/blog/best-fido2-hardware-security-keys) for
   passkey authentication or a third-party
   [password manager](https://www.corbado.com/blog/passkeys-vs-password-managers), such as
   [1Password](https://www.corbado.com/blog/1password-passkeys-best-practices-analysis),
   [Dashlane](https://www.corbado.com/blog/dashlane-passkeys) or Google Password Manager in Chrome, that has
   cross-platform sync capabilities for passkeys.

Developers and product managers should be aware that passkey behavior may vary depending
on whether Windows Hello is enabled, and cross-device WebAuthn authentication may require
additional steps. However, as passkeys and passwordless solutions continue to evolve, the
options for integrating these features on devices with different setups will only expand.

## Frequently Asked Questions

### How do I use passkeys on Windows 11 without Windows Hello enabled?

Without Windows Hello, local platform authentication is unavailable, but you can still use
cross-device authentication via QR codes and Bluetooth or hardware security keys.
Alternatively, signing into a Google profile in Chrome lets you use Google Password
Manager's passkey sync, which requires a six-digit recovery PIN instead of Windows Hello.

### What happens when a user without Windows Hello tries to create a passkey on Windows 11?

Windows 11 will display a prompt asking the user to activate Windows Hello before
proceeding with passkey setup, which can cause confusion. Developers can prevent this by
using isUserVerifyingPlatformAuthenticatorAvailable() to detect Windows Hello status
upfront and fall back directly to alternative methods like email OTP, bypassing the prompt
entirely.

### Can a local Windows 11 account without a Microsoft account still use Windows Hello and passkeys?

Yes, as of October 2024 a local Windows 11 account can have Windows Hello activated,
enabling biometric authentication without a Microsoft account. In this configuration
passkeys are device-bound rather than synced, since passkey syncing via Microsoft accounts
is not yet available.

### What is the difference between passkey-ready and Conditional-UI-ready on a Windows 11 device?

Passkey-ready, also called Platform-Auth-Ready, means a local platform authenticator such
as Windows Hello is active and can create or use passkeys on-device. Conditional-UI-ready
means the device supports cross-device authentication and can surface synced passkeys from
third-party managers like Google Password Manager, even when Windows Hello is off.