Passkeys vs. Passwords: Which Is Safer and How the Change Works

What a passkey is

A passkey is a pair of keys created by your device when you sign up for a site. The private key stays on your device or in an encrypted vault that syncs between your devices. The public key goes to the website, and it is useless on its own.

When you sign in, the site sends a challenge, your device unlocks the private key after your face, fingerprint, or device PIN, and signs the challenge. Apple’s description is short: the site never learns what the private key is.

The biometric part is worth being precise about, because it causes confusion. Your fingerprint or face is not sent anywhere and is not the passkey. It is only the local gate that unlocks the key already sitting on the device. If you prefer, the device PIN does the same job.

The technology underneath is an open standard, which is why the same passkey concept appears across platforms. Microsoft’s overview of passkeys and Google’s guide to signing in with a passkey describe the same mechanism in their own words.

Why phishing does not work the same way on a passkey

Phishing works because a password is a secret you can be talked into repeating. A passkey removes the thing you could repeat, and ties the credential to the real site’s web address, so a look-alike page gets nothing it can use.

Two properties do the work. First, the private key never leaves your device, so there is no secret to hand over even if you want to. Second, the browser will only offer a passkey to the exact site it was registered with, so a convincing copy at a slightly different address simply does not get a passkey offered.

That second property is the part people underestimate. With a password or a typed code, the defense depends on you spotting the wrong address at the worst possible moment, usually in a hurry, on a small screen. With a passkey, the defense does not depend on you noticing anything.

This is what security agencies mean by phishing-resistant. CISA’s October 2022 fact sheet on implementing phishing-resistant MFA calls this category the gold standard, and NIST Special Publication 800-63B, Revision 4, published in August 2025, requires phishing resistance at its highest assurance level.

What a passkey does not do is protect the rest of the account. A criminal who can reach your account through password recovery, a support line, or an old text-message code does not need to defeat the passkey at all, and that is the honest limit of the whole idea.

Passkeys and passwords, side by side

Passkeys win on the attacks that cause most account takeovers, and passwords still win on universality and on being usable anywhere, on anything, including a borrowed computer in a hotel lobby.

Reuse. A password can be reused across sites, so one breach spreads. A passkey is unique to one site by construction.

Breaches. A stolen password database is immediately useful to a criminal. A stolen list of public keys is not.

Phishing. A password can be typed into a fake page. A passkey is not offered to the wrong address.

Where it works. Passwords work on every site and every device. Passkeys work where the site supports them, which is now most large platforms and banks but far from everything.

Sharing. Passwords are easy to share, which is convenient and usually a bad idea. Passkeys are harder to share, which is safer and occasionally annoying for a household account.

Recovery. A forgotten password is reset by email. A lost passkey depends on your platform account, your password manager, or a backup method you set up earlier.

What happens if you lose the device

In almost every normal setup, losing the phone does not lose the passkey, because the passkey is synced and encrypted rather than trapped on one handset. Whether that is true for you depends on one choice you made when you created it, so it is worth knowing which kind you have.

Synced passkeys

These are the default on phones and in password managers. The passkey is stored in an encrypted keychain or vault that syncs to your other devices and is restored when you sign in on a new one. Apple documents its keychain as end-to-end encrypted, with recovery protected by limited authentication attempts. Google describes the same restore path for passkeys saved to a Google Account. In practice: buy a new phone, sign in to the platform account, and the passkeys come back.

Device-bound passkeys

These live on one piece of hardware, typically a physical security key, and cannot be copied off it. That makes them the strongest option and the least forgiving. NIST notes that syncable authenticators are not permitted at the highest assurance level precisely because their keys can be exported. If you use device-bound keys, own two and register both.

The thing that actually strands people is neither of those. It is losing access to the account the passkeys sync with, which usually means the platform account password and its second factor. That account is now the master key, and it deserves the strongest protection you have.

How to start without breaking anything

Add passkeys in a way that always leaves a second route in, and do not begin with the account that everything else resets through. Two devices before you rely on one, and backup codes saved before you need them.

1. Make sure your platform account is solid first. The Apple, Google, or Microsoft account that will hold the passkeys needs a strong unique password and a second factor, because it becomes the recovery path for everything else.
2. Pick a low-stakes account to learn on. A shopping or forum account, not your bank and not your email.
3. Create the passkey in account settings, usually under security, sign-in, or passwords. Microsoft documents creating and saving a passkey step by step.
4. Register a second passkey on a second device where the site allows it, or keep a security key as a spare.
5. Save the account’s backup codes somewhere off the device, such as printed with your important papers.
6. Sign out and sign back in with the passkey before you trust it. Do this while the old password still works.
7. Only then consider removing the password, and only on sites that clearly show what the remaining recovery route is.
8. Do your main email last, once the rest of the pattern is familiar.

Where passkeys still fall short

The technology is solid; the rough edges are practical. Most of them show up in situations that are common rather than exotic.

Not every site supports them, so you will run a password manager alongside passkeys for years. That is normal, not a failure.

Signing in on someone else’s computer is awkward. The usual route is a code scanned with your phone, which works but is slower than typing a password, and some sites still do not support it.

Shared household accounts fit passkeys badly. A streaming account used by four people is easier with a shared password in a manager’s shared folder.

Moving between platforms has improved but is not seamless. Passkeys stored in one company’s keychain do not always travel to another, which is one reason some people keep passkeys in a cross-platform password manager instead.

Work accounts follow the employer’s rules, not yours, and may require a device-bound key.

The device lock becomes load-bearing. A phone with a four-digit PIN and no auto-lock is a weaker gate than the passkey behind it deserves.

Do you still need two-factor authentication?

A passkey already combines two factors in one step: something you have, which is the device holding the private key, and something you are or know, which is the biometric or PIN that unlocks it. On a site where the passkey is the only way in, a separate second factor adds little.

In practice most accounts are not there yet. As long as a password still works on the account, the second factor is still protecting that password, so leave it on. The comparison of two-factor methods covers which to keep where.

The one thing worth removing early is text-message recovery on accounts that hold money or identity, because a phone number can be taken over in a SIM swap. Swap it for an authenticator app or a security key before you rely on passkeys for anything important.

Before you change your main email

Your main email account is the recovery route for nearly everything else, so treat it as the last step rather than the first, and set it up so no single lost object locks you out.

Register passkeys on at least two devices you control. Save and print the backup codes. Check that the recovery phone number and recovery email on the account are ones you still hold, and that neither points at an address you abandoned years ago. Keep a strong unique password on the account even after passkeys work, until you are confident.

Then check the other side of the door. The FTC’s guidance on phishing is still relevant after you switch, because the messages will simply change target: instead of asking for a password, they will ask you to approve something, reset something, or call a number. A passkey protects the sign-in. It does not protect a decision.

Passkeys FAQ