Passkeys vs Passwords: What Changes and What Doesn’t
Passkeys replace passwords with a cryptographic key pair stored on your device, letting you sign in with a fingerprint, face scan, or PIN instead of typing a secret string. They eliminate phishing, password reuse, and most credential theft, but they do not remove the need for account recovery, device trust, or careful security hygiene. In short, passkeys change the authentication method, not the underlying responsibilities of securing your accounts.
What Exactly Is a Passkey?
A passkey is a digital credential based on public-key cryptography. When you create a passkey for a website, your device generates two mathematically linked keys: a public key, which is stored on the website’s server, and a private key, which never leaves your device. During sign-in, the website sends a challenge, your device signs it with the private key, and the server verifies the signature using the public key. This proves you possess the private key without ever transmitting it.
Passkeys follow the FIDO2 and WebAuthn standards, which are supported by major operating systems and browsers. On Apple devices, passkeys sync through iCloud Keychain; on Android, they sync through Google Password Manager; Windows and third-party password managers also support them. Because the private key is tied to your device’s secure enclave, unlocking it requires your biometric or a local PIN.
How Passkeys Are Different from Passwords
The core difference is the secret itself. A password is a shared secret: you and the server both know it, so anyone who steals it from either side can impersonate you. A passkey’s private key is never shared, and the public key alone cannot be used to sign in. Even if a server is breached, the attacker gets only public keys, which are useless for authentication.
Another major difference is resistance to phishing. With a password, you can be tricked into typing it into a fake website. With a passkey, the cryptographic challenge is bound to the website’s domain, so a passkey created for example.com simply will not work on example.com.evil.net. The browser and operating system enforce this binding, making phishing significantly harder.
Passwords also suffer from reuse. People use the same password across dozens of sites, so one breach compromises many accounts. Passkeys are unique per site by design; there is no way to reuse them.
What Passkeys Don’t Change
Passkeys do not eliminate all security risks. They do not protect against malware that runs on your device and can intercept your session after authentication. They do not stop a thief who steals your unlocked phone. They do not remove the need for account recovery: if you lose all your devices, you still need a backup method, often a recovery code or a secondary email, which could be password-based.
Passkeys also do not change the fact that you must trust the device manufacturer and the cloud service that syncs your passkeys. If your iCloud or Google account is compromised, an attacker could potentially access your synced passkeys, though they would still need your biometric or PIN to use them.
Finally, passkeys do not solve the problem of account takeover through social engineering. If you approve a login request on your phone without checking the details, or if you share your device with someone you trust, a passkey won’t help.
How to Start Using Passkeys
Adoption is growing, but not every website supports passkeys yet. Here is a practical approach:
- Check your password manager or device settings for a passkey management section. Most major managers now support them.
- When you sign in to a supported site, look for an option like “Create a passkey” or “Use passkeys” in the security settings.
- Create a passkey for your most important accounts first: email, banking, social media, and cloud storage.
- Keep your device’s biometric unlock enabled and your operating system updated.
- Set up a recovery method for each account, such as a recovery code or a trusted phone number.
You can still use passwords for sites that don’t support passkeys. Most services let you keep both, so you can transition gradually without losing access.
Common Problems and Misconceptions
“Passkeys are less secure because they are stored on the cloud.” The private key is encrypted and tied to your device’s secure hardware. Even if the cloud service is breached, the encrypted keys are useless without your biometric or PIN.
“I can’t use passkeys on multiple devices.” Passkeys sync across devices from the same ecosystem (Apple, Google, Microsoft) and can be used on other devices via a QR code or Bluetooth proximity, though this is less convenient.
“What if I lose my phone?” You can recover your account using the recovery method you set up, or by using a passkey from another synced device. Some services let you print a recovery code at passkey creation.
“Passkeys are only for phones.” They work on desktops and laptops too, using Windows Hello, Touch ID, or a security key. The experience is similar: you click the sign-in button and approve it with a fingerprint or PIN.
“Can I export my passkeys?” Most platforms allow you to move passkeys to another password manager, but the process is not standardized. Check your manager’s documentation for export options.
Passkeys vs. Password Managers vs. Security Keys
Passwords managers store your passwords in an encrypted vault, often with two-factor authentication. They solve the reuse problem but not phishing: you can still be tricked into entering your master password on a fake site. Security keys (hardware tokens) provide strong phishing resistance but require carrying a physical device and are less convenient for everyday use.
Passkeys combine the convenience of a password manager with the phishing resistance of a security key. They are effectively a software-based security key that uses your device’s biometric as the PIN. However, they are not portable in the same way as a hardware key; you cannot simply plug them into a friend’s computer without a syncing mechanism.
Costs and Requirements
Passkeys themselves are free; they are built into your operating system and browser. The cost is in device requirements: you need a relatively modern device with a secure enclave (most phones and laptops from the last five years) and a biometric sensor or a PIN. Older devices may not support passkeys, so you may need to keep passwords as a fallback. There is no subscription fee, and most websites do not charge for enabling passkeys.
Frequently Asked Questions
Can I use a passkey on a public computer? Not directly. Public computers don’t have your private key. You can use your phone as a passkey via QR code or Bluetooth, but the public computer must support WebAuthn. Most modern browsers do.
What happens if I clear my browser data? Passkeys are stored in the operating system’s credential manager, not in browser cookies, so clearing browser data won’t delete them. However, if you use a browser that doesn’t sync passkeys, they may be lost when you switch devices.
Are passkeys the same as two-factor authentication? No. Passkeys are a single factor (something you have, plus something you are) and replace passwords entirely. Two-factor authentication adds a second layer on top of a password. Some services use passkeys as a second factor, but the standard use is as a password replacement.
Can a passkey be stolen? The private key is encrypted and protected by your device’s secure hardware. An attacker would need physical access to your unlocked device, or a sophisticated attack on the secure enclave, which is extremely difficult. The public key is not sensitive.
Will passkeys work with all websites? No. Adoption is increasing, but many sites still only offer passwords. You can use passkeys on major platforms like Google, Apple, Microsoft, and many financial services, but smaller sites may lag.
Do I still need a password if I have a passkey? For most accounts, you can disable the password after setting up a passkey, but some services require a password as a backup for recovery. It’s safest to keep a strong, unique password as a fallback until passkeys are universally supported.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.