Passwords fail for a structural reason, not a discipline reason. A password is a shared secret: you know it, the service knows it, and anything that can impersonate the service can ask you for it. No amount of length or complexity fixes that. Passkeys change the mechanism.
The short version
- A passkey is a key pair. The private half never leaves your device; the service only ever stores the public half.
- There is nothing reusable to steal — a breached service leaks public keys, which are useless to an attacker.
- Passkeys are bound to the real domain, so a convincing phishing page simply cannot trigger them.
- The hard part is no longer login. It is account recovery.
What actually happens when you sign in
When you create a passkey, your device generates a key pair. It sends the public key to the service and keeps the private key locked in secure hardware — a Secure Enclave, a TPM, or a hardware security key. To sign in, the service sends a random challenge; your device signs it with the private key; the service verifies the signature against the public key it already holds.
Your biometric or device PIN never travels anywhere. It unlocks the private key locally. The service never sees your face, your fingerprint or your PIN — it only sees a valid signature.
A password database is a pile of secrets worth stealing. A passkey database is a pile of public keys worth nothing.
Why phishing stops working
This is the part that matters most, and it is easy to miss. Every passkey is cryptographically bound to the domain it was created for. Your browser will only offer a passkey to the origin it belongs to.
So when a convincing replica of your bank asks you to sign in, there is no passkey to offer. Not because you were alert enough to check the address bar, but because the browser checked for you and found no match. The attack does not fail at the human — it fails at the protocol. That is the whole point, and it is why passkeys are a genuine improvement rather than a repackaging.
Where passkeys are stored, and the tradeoff you are choosing
Passkeys have to live somewhere, and the choice determines what happens when you lose a device.
- Platform keychain (Apple, Google, Microsoft accounts). Syncs across your devices automatically. Convenient; ties you to an ecosystem and makes that account extremely valuable to protect.
- Third-party password manager. Cross-platform and portable between ecosystems. Moves the trust to the manager’s own security.
- Hardware security key. The private key never syncs anywhere. Strongest guarantee, worst recovery story if you lose the key and have no backup.
None of these is correct in general. A synced keychain is the right default for most people; a hardware key is right when compromise would be catastrophic. What is not sensible is holding a single hardware key with no registered backup.
The problem nobody advertises: recovery
If your passkeys live in secure hardware and that hardware is at the bottom of a lake, you need a way back into your accounts. Every recovery mechanism is also, by definition, an alternative way in — which means it is the new weakest link.
Many services still fall back to email or SMS for recovery. If that is true of an account, then the practical security of your passkey is capped by the security of your email account or your phone number. SMS in particular is vulnerable to SIM-swap attacks, where an attacker persuades a carrier to move your number to their device.
- Register passkeys on at least two devices, or use a synced keychain and protect that account seriously.
- Print or write down recovery codes where a service offers them, and store them physically.
- Secure your email account first — it is the recovery path for almost everything else.
- Remove SMS as a recovery method wherever an alternative exists.
What passkeys do not fix
Passkeys protect the moment of authentication. They do nothing about what happens afterwards. Session tokens can still be stolen by malware on your machine; a service can still be breached and leak your data; and an attacker who compromises the device holding your keys has bypassed the question entirely.
They also do not protect you from being socially engineered into doing something harmful while legitimately signed in. Authentication is one link in the chain, and the surrounding advice about device hygiene and update discipline still applies.
Should you switch now?
Enable passkeys on your most valuable accounts — email first, then anything financial — while keeping a working fallback until you have confirmed recovery works. Do not delete your password on an account until you have actually tested signing in from a second device.
Expect a mixed experience for a while. Support across browsers, operating systems and individual sites is uneven, and some implementations are better than others. That is an argument for a staged move, not for waiting.
Frequently asked questions
If someone steals my phone, can they use my passkeys?
Only if they can also unlock the device. The private key is released by your biometric or device PIN, so a locked phone is not usable for authentication. This is why a weak device PIN undermines the whole arrangement.
Do passkeys work across different ecosystems?
Increasingly, yes — through cross-device sign-in, where you approve on your phone to sign in on another machine, and through third-party password managers that sync passkeys everywhere. It is smoother within one ecosystem than across several.
Is a passkey the same as two-factor authentication?
It replaces both factors at once. A passkey requires possession of the device and a local unlock, so it is inherently multi-factor. Layering an SMS code on top of a passkey usually weakens it rather than strengthening it.
