What passkeys are, and whether to use them yet — starting with the lost phone
Logging in without a password. The gain is clear, and most explanations skip the one question people actually hesitate over.
“Continue with a passkey” turns up on more login screens than it used to, and plenty of people back out and use the password instead because they don’t know what happens next.
This article covers only what you need to decide. In particular it starts with what happens if you lose the device. Most explanations leave that until the end, and it is the exact reason people hesitate.
What is different
A password is a value you and the service both know. So when the service is breached that value leaks, and if you used it anywhere else, those accounts open too.
A passkey uses a key that only exists on your device to produce a signature. The service checks the signature and never receives the key.
Three things follow automatically.
- A breach at the service doesn’t leak your key. There is no key on their side
- It cannot be used on a fake site. The key only works on the address it was registered for, so on a phishing page it simply does nothing
- There is no reuse. A separate key is made for every service
The second is the one that matters most in practice. A password manager still lets you type a password into a fake site yourself; with a passkey that route is closed.
So what if you lose the device
The important question. The answer depends on where it was stored.
Stored somewhere that syncs — iCloud Keychain, Google Password Manager, a manager like 1Password. This is the default and covers most people. Sign in to a new device with the same account and the passkeys come with you. Losing the device does not lose the account.
Stored only on that device — a hardware security key, or syncing deliberately turned off. Lose it and that passkey is gone.
Which means the safety net for a passkey is the account holding it. Turned around: that account (Apple, Google, your manager) now matters more than it did. Putting two-factor authentication on it is close to a precondition for using passkeys at all.
How to start
- Don’t delete your password first. Most services keep it when you add a passkey. Start in that state
- Create a passkey on one service you use often
- Log in from a different device. This is where you find out whether syncing actually works. Skip it and you find out at a worse moment
- Live with it for a few weeks, then widen to other services
Step 3 is the point. “I created one” and “it works on my other device” are different facts, and now is the cheap time to check.
Where it still snags
Honestly, it is not smooth yet.
- Services call it different things. Passkey, sign in with your device, biometric login can all mean the same thing
- Behaviour varies by browser and operating system. Using an iPhone passkey on Windows routes through a QR code
- Work accounts are sometimes blocked by an administrator
- Even where a service supports passkeys, some actions still ask for the password
So “switch everything to passkeys” is premature. One service at a time, where it works, is the realistic version.
If you already use a password manager
The case for switching gets a little weaker. Used properly, a manager already means no reuse and long passwords.
Phishing resistance is still structurally stronger with passkeys, though. A manager cannot stop you copying something into a fake site yourself. Whether that difference is worth the move is the actual question.
Things like your Wi-Fi password and your router’s admin password are outside what passkeys reach at all. Those stay a separate job.
In short
| Question | Answer |
|---|---|
| What’s different | The key stays on your device. The service only checks a signature |
| Biggest gain | It cannot be used on a fake site |
| If I lose the device | With syncing on, it follows you to a new one |
| So what matters now | The account holding the passkeys. Put 2FA on it |
| Can I delete my password | Not yet |
| The one thing to check | After creating one, log in from another device |
| Should I switch everything | Too early. Where it works, one at a time |
Passkeys are one of the rare cases where the safer option is also the more convenient one. Just start knowing that the safety net moves from the device to the account.