Passkeys vs Passwords: What Actually Changes for You

A password is a shared secret. You know it, the site stores a scrambled version of it, and anything that convinces you to type it somewhere else gets a working copy. Every password problem grows out of that one property: reuse, database breaches, phishing pages, and the reason you were told to memorise sixteen random characters.

A passkey is a key pair instead. Your device generates two mathematically linked keys. The site keeps the public one, which is useless on its own. The private one stays on your device or in your synced keychain and never gets transmitted. Signing in means your device proves it holds the private key by signing a challenge, after you approve it with a fingerprint, face or device PIN.

The important consequence is not convenience, although it is more convenient. It is that a passkey is bound to the site it was created for. Your device checks the domain before it will sign anything. A convincing replica at a lookalike domain does not get a passkey prompt at all, because the browser will not offer a key that does not match. The class of attack where a person is tricked into typing a real credential into a fake form simply has nothing to take.

That also removes the ritual around passwords. Nothing to memorise, nothing to rotate, nothing to reuse by accident, and nothing useful for an attacker to steal from a site's database, because the public key on file does not open anything.

What it does change is recovery. With passwords, forgetting one is routine and recovery flows are mature. With passkeys, the question becomes what happens when the device holding the key is lost. There are two broad models. Synced passkeys live in a keychain that follows your account across devices, so a new phone inherits them after you sign into iCloud, your Google account, Windows Hello or a password manager. Device-bound passkeys, including those on hardware security keys, never leave the hardware they were made on, which is stronger and less forgiving.

The practical setup is to make sure you are never one lost device away from being locked out. Register a passkey on at least two devices for accounts you cannot afford to lose, or keep a hardware key in a drawer as a second registration, and know where your account's recovery codes are. Most services still keep a password or an emailed link as a fallback, which is worth checking: a passkey on an account whose fallback is an unprotected email inbox has moved the weak point rather than removed it.

Adoption is uneven, and will be for a while. Large platforms support passkeys well, plenty of mid-sized services support them partially, and some still do not offer them at all. The sensible approach is neither to convert everything at once nor to wait. Add passkeys where they are offered on the accounts that matter most, which is usually email first, because email is the master key to everything that still uses password reset.

Keep the password manager either way. It still holds the credentials for everything that has not caught up, and increasingly it is where your passkeys live too.