The password has survived roughly sixty years of attempts to kill it, which makes scepticism about its latest challenger reasonable. But passkeys are different from previous contenders in one structural way: they remove the thing attackers actually want. There is no shared secret sitting in a database waiting to be stolen.
This article explains what a passkey is, what it fixes, and where it still creates friction.
The problem with passwords is architectural
Every password system has the same design flaw. You know a secret, the website knows a version of that secret, and authentication happens by comparing them. That requires the secret to travel across the network and to be stored at the other end.
Both of those steps are exploitable. If the secret travels, it can be intercepted — or, far more commonly, you can be tricked into sending it to the wrong place. If the secret is stored, the store can be breached. Modern sites hash passwords rather than storing them in plain text, which helps enormously, but hashes of weak passwords are still crackable at scale, and a large fraction of real-world passwords are weak or reused.
Password reuse turns a breach at one careless company into a compromise of your email, your bank, and your cloud storage. Credential stuffing — taking username and password pairs from one breach and trying them everywhere else — remains one of the highest-volume attack techniques in existence precisely because it works so often.
Two-factor authentication was the patch. It helped a great deal, but SMS codes can be intercepted through SIM swapping, and even app-generated codes can be phished in real time: a convincing fake login page asks for your code, relays it to the real site within the thirty-second window, and the attacker is in.
What a passkey actually is
A passkey is a pair of cryptographic keys generated on your device when you register with a site.
The private key never leaves your device. It is stored in secure hardware — the Secure Enclave on Apple devices, the Titan or equivalent security chip on Android, a TPM on Windows machines, or a physical security key like a YubiKey. The public key is sent to the website and stored there.
When you log in, the site sends your device a random challenge. Your device asks you to prove you are present and are who you say you are — a fingerprint, a face scan, or the device PIN — and then uses the private key to sign that challenge. The site verifies the signature against the public key it holds.
Three consequences follow, and they are the whole argument for passkeys.
Nothing secret is transmitted. The signature is useless to anyone who intercepts it; it only answers that one challenge, once.
Nothing secret is stored on the server. A breach of the website yields a pile of public keys, which are public by design. There is nothing to crack and nothing to stuff into other sites.
Phishing stops working. This is the elegant part. Each passkey is cryptographically bound to the exact domain it was created for. A passkey created for yourbank.com will not respond to a request from yourbank-secure-login.com, no matter how convincing the page looks, because the browser checks the domain before the key is ever used. The user cannot be tricked into overriding it, because there is no step where the user hands anything over.
That last point deserves emphasis. Most security advice asks users to be vigilant. Passkeys remove the need for vigilance by making the attack technically impossible rather than merely inadvisable.
Where your passkeys live
The natural objection is obvious: if the private key is on my phone, what happens when I lose my phone?
In practice passkeys are synchronised through a credential manager, and you almost certainly already use one. Apple syncs them through iCloud Keychain, Google through Google Password Manager, Microsoft through Windows Hello and your Microsoft account. Third-party managers such as 1Password and Bitwarden also support them, and have the advantage of working across every platform rather than within one company’s ecosystem.
The sync is end-to-end encrypted, so the provider cannot read your private keys. If you lose a device, you restore your passkeys on a new one by authenticating to the sync account — which means the security of that account becomes critical. Protect it with its own strong authentication and store the recovery codes somewhere offline.
There is a meaningful choice here. Platform-bound managers are frictionless if you live entirely inside one ecosystem and painful if you do not. A cross-platform manager costs a few pounds a month and removes the awkwardness of logging into a work Windows machine with passkeys stored in iCloud. For most people with a mixed device setup, the cross-platform option is worth the money.
For the security-conscious, hardware keys offer a third model: the passkey is bound to a single physical object and never syncs anywhere. This is the strongest configuration and the least forgiving. Buy two, register both with every important account, and keep the second in a drawer.
The awkward parts
Passkeys are genuinely better, and it would be dishonest to present the transition as seamless.
Account recovery is the weak link. A site can have perfect passkey implementation and still be compromised if its “lost access” flow falls back to an emailed link or a knowledge-based question. Attackers move to the weakest path, and for many services that path is still a password reset. Passkeys raise the floor, but the recovery flow determines the ceiling.
Coverage is uneven. Large platforms — Google, Apple, Microsoft, Amazon, PayPal, most major password managers — support passkeys well. Regional banks, government portals, smaller retailers and a great deal of enterprise software do not. You will be running both systems for years.
Shared accounts are clumsy. The family streaming login, the small business account four people use, the handover when someone leaves a job. Passwords are trivially shareable, which is exactly the property that makes them insecure, and passkeys deliberately lack it. Some managers now support shared passkey vaults, but the workflow is not yet as smooth as passing a password along.
Device loss without sync is unrecoverable. If you use hardware keys or disable sync, losing your only key means falling back on whatever recovery the site offers. Registering a second key is not optional advice here.
A sensible migration plan
You do not need to convert everything, and trying to will only produce frustration. Work in order of value to an attacker.
Start with your email account. Everything else resets through it, so it is the single highest-value target you own. Add a passkey, keep the existing strong password and 2FA as backup, and make sure recovery codes are stored offline.
Next, your password manager or sync account, for the same reason. Then financial services and anything holding payment details, then cloud storage, then social accounts where impersonation would cause real damage.
For everything else, keep using a password manager with long random unique passwords. That remains an excellent defence, and it is a far better use of your attention than trying to force passkeys onto services that half-support them.
Do not delete your old passwords as you go. During this transition period, sites occasionally break their passkey flow, and a working fallback is worth keeping. Think of it as adding a better front door rather than bricking up the old one.
What to expect over the next few years
The direction is clear even if the timeline is not. Major platforms are steadily moving passkeys from an option to the default, and some are beginning to make passwords optional to set at all. Regulatory pressure in financial services is pushing in the same direction, since phishing-resistant authentication satisfies strong customer authentication requirements more cleanly than SMS codes ever did.
The realistic end state is not a world without passwords. It is a world where passwords survive in the long tail of small and legacy services, while everything that matters has moved to something that cannot be handed over by a tired person clicking a convincing link at eleven at night.
That is a meaningful improvement, and it is available now for the handful of accounts that matter most. Setting it up on your email takes about two minutes.