Passkeys explained: the password's long-overdue replacement

Passwords fail for a structural reason: they are a shared secret, so anyone who obtains a copy becomes you. Passkeys replace the shared secret with a key pair, which removes phishing and credential-stuffing as categories of attack rather than merely making them harder.

What a passkey actually is

When you create a passkey, your device generates two mathematically linked keys. The private key stays on your device, protected by its secure hardware, and never leaves. The public key goes to the website, which stores it openly — it is not a secret and is worthless to a thief.

Signing in works by challenge and response. The site sends a random challenge; your device signs it with the private key; the site verifies the signature against the stored public key. You never transmit anything reusable. There is no secret in the exchange for an attacker to intercept and replay.

Why this kills phishing outright

This is the part that matters most, and it is worth being precise about. A passkey is bound to the exact domain it was created for. Your browser will only offer a passkey created for your bank's real domain to that real domain. A convincing replica at a lookalike address gets nothing offered — not a warning you can click through, not a mistyped-password moment. There is simply no credential available to hand over.

Contrast this with any password-based scheme, including one protected by codes from an authenticator app. A person who has been convinced they are on the real site will type both their password and their six-digit code into the fake one, and a real-time relay attack forwards both to the genuine site within the code's validity window. Passkeys are immune to this because the browser, not the user, decides which credential belongs to which domain — and the browser cannot be socially engineered.

The other class of breach it prevents

When a site is breached and its password database leaks, the immediate damage is to that site, and the larger damage is everywhere else the same password was reused. Credential stuffing — replaying leaked combinations across hundreds of other services — is responsible for an enormous share of account takeovers.

A leaked passkey database contains only public keys. There is nothing to crack, nothing to reuse, and no benefit to the attacker. The reuse problem disappears not through better user discipline but because there is nothing reusable in the first place.

Where your passkeys actually live

Three arrangements exist, with different trade-offs.

1. Synced through a platform. Apple's iCloud Keychain, Google Password Manager and Windows Hello sync passkeys across your devices in that ecosystem, encrypted end to end. This is the most convenient option and what most people will use by default.
2. Synced through a third-party manager. Most major password managers now store passkeys and work across platforms, which matters if you mix an Android phone with a Mac. This avoids being locked into one vendor's ecosystem for your credentials.
3. On a hardware key. A physical security key holds passkeys that never sync anywhere. Maximum security, no cloud dependency, and the obvious risk: lose the key without a backup and you lose the accounts.

The device-loss question everyone asks

The honest answer depends on which arrangement you chose. Synced passkeys survive device loss — sign in to your account on a new device and they are there, which is the entire point of syncing. Hardware-key passkeys do not, which is why the standard advice is to register two keys and store the second somewhere safe.

Regardless of arrangement, keep a recovery route on every important account: a second passkey on a different device, saved recovery codes stored offline, or a verified backup email. This is not passkey-specific advice, but the transition is a natural moment to check it, because most people discover their recovery options are stale precisely when they need them.

Cross-device sign-in, and why it is secure

Signing in on a device that has no passkey — a desktop at work, a friend's computer, a smart TV — works by QR code. The site shows a code, you scan it with the phone holding the passkey, and the phone signs the challenge.

Two details make this trustworthy. The phone and the computer must also be in Bluetooth proximity, which prevents someone from emailing you a QR code and having you authenticate their session from another continent. And the private key still never moves; the phone signs and sends only the signature. The desktop never holds a credential, so nothing is left behind on a machine you do not control.

Starting today, in a sensible order

Do not attempt a wholesale migration. Add passkeys to the accounts where a takeover would be most damaging, in this order: your primary email, because it is the reset route for everything else; your password manager; your financial accounts; then your main cloud storage and any account tied to a payment method.

The setting is usually under security options, labelled "passkeys" or "sign in without a password". Adding a passkey does not remove your password — both work — which makes the first steps low-risk. Once you have used the passkey for a few weeks and confirmed your recovery routes, you can remove the password on sites that permit it.

What is still awkward

Coverage is uneven. Adoption is strong among large platforms and thin among smaller services, so you will be managing both systems for years. Some implementations are confusingly worded, presenting a passkey as an additional second factor rather than a password replacement.

Moving passkeys between ecosystems has been genuinely difficult, though a credential-exchange standard is arriving to address exactly this. And shared accounts remain unresolved: passkeys are bound to individuals by design, which is a security feature and a household inconvenience.

Whether it is worth the effort

For the handful of accounts that control everything else, unambiguously yes — the phishing immunity alone justifies it, because phishing is the attack that actually reaches ordinary people. For the long tail of forum logins, a password manager with unique generated passwords remains perfectly adequate.

The useful framing is not passkeys everywhere but passkeys where the damage is concentrated. That is perhaps six accounts, and it is an afternoon's work.

Setup steps and available options differ between services and device platforms. Always confirm you have a working recovery method before removing an existing password.