Every few years something is announced as the end of passwords, and passwords carry on regardless. Passkeys are different in one meaningful way: they remove the thing attackers actually steal. Here is what is genuinely new, and what the trade-offs really are.
The problem passkeys solve
A password is a shared secret. You know it, and the website knows it. That single design choice creates most of the mess we live with:
- It can be stolen from the website's database, which happens constantly.
- It can be typed into a convincing fake site, which is what phishing is.
- It can be reused across services, so one breach unlocks several accounts.
- It can be guessed, if it is short or predictable.
A passkey is not a shared secret. It is a key pair. Your device keeps the private half and never sends it anywhere. The website stores only the public half, which is useless to a thief. When you sign in, the site sends a challenge, your device signs it, and the site verifies the signature.
The consequence: there is nothing to leak in a breach, nothing to reuse, and nothing you can be tricked into typing somewhere else.
Why phishing stops working
This is the part worth understanding properly, because it is the strongest argument.
A passkey is cryptographically bound to the exact domain it was created for. If you created one
for example.com, your device will only offer it to example.com. Land
on example-login.net — a perfect visual replica — and the passkey simply does not
appear. There is no prompt, no autofill, nothing to hand over.
Your device checks the domain, and your device does not get tired, rushed or fooled by a convincing logo. That removes the human judgement that attackers spend all their time attacking. It also defeats the real-time relay attacks that can bypass one-time codes, because there is no reusable secret to relay.
What using one feels like
You unlock it the way you unlock your device: fingerprint, face, or device PIN. That biometric is used locally to unlock the key — it is not sent to the website, and the website never receives your fingerprint. In practice signing in becomes faster than typing a password, which matters, because security that is slower than the insecure option tends to lose.
The honest trade-offs
Anyone telling you this is pure upside is selling something.
- Account recovery is the real weak point. If your passkeys are tied to one device and you lose it, you fall back to recovery — which usually means email or SMS, the weaker methods you were trying to escape. Synced passkeys in a platform or password-manager account solve this, but then that account becomes the thing worth protecting most.
- Coverage is still patchy. Major platforms support passkeys; plenty of services do not. You will be running both models for a while.
- Ecosystem friction. Moving passkeys between platforms has improved but is still not seamless. Using a cross-platform password manager avoids most of this.
- Shared accounts are awkward. Passkeys assume one person per identity, which is correct, but it does expose teams that have been quietly sharing a login.
What to do, in order
- Start with your email account. It is the recovery path to everything else. Protect it first, and protect it best.
- Then anything financial, then anything with payment details stored.
- Keep a second factor as a backup while you transition, rather than deleting everything else on day one.
- Decide where passkeys live — platform account or password manager — and secure that with the strongest protection available. This is now your crown jewel.
- Clean up recovery options. A phishing-resistant passkey on an account that can be reset via an old, unprotected email address is a strong front door next to an open window.
Your one action this week: add a passkey to your primary personal email account. It takes about two minutes, and it is the single highest-value identity change most people can make.