Passkeys: Understanding and Adopting the Password Alternative

Passkeys replace passwords with a cryptographic key tied to your device. No more memorizing, typing, or resetting anything. Here's how it works, what it changes in practice, and what you need to know before adopting them.

What is a passkey and how does it work?

A passkey is a pair of cryptographic keys — one private, stored on your device, and one public, registered with the online service. To sign in, your device proves it holds the private key without ever transmitting it.

In practice, each time you sign in, the server sends a unique challenge (a random string). Your device signs it with the private key, and the server verifies the signature using the public key. Even if someone intercepts that signed response, it's useless: it's only valid for that specific challenge, which has already been consumed. This is fundamentally different from a password, which is always the same and can always be replayed.

Authentication is triggered by a simple gesture: Touch ID, Face ID, a fingerprint scan, or your device PIN.

Are passkeys really more secure than a password?

Yes, by a wide margin. Passkeys rely on elliptic-curve cryptography (P-256 / ECDSA), delivering approximately 128 bits of effective security. To reach an equivalent level with a password, you would need roughly 20 completely random characters drawn from the 95 printable ASCII characters — something no human naturally generates or memorizes.

Beyond raw strength, passkeys eliminate an entire category of risks:

No weak or reused passwords across sites
No password database to steal (the server only stores the public key, which is useless without the private key)
No credential stuffing (testing millions of username/password pairs from data breaches)
No forced password rotation every 90 days
No absurd password rules (uppercase required, special character, no more than 16 characters…)

Why are passkeys resistant to phishing?

A passkey is cryptographically bound to the exact domain for which it was created. On a fake site — even one that looks visually identical — the passkey simply won't activate. There is nothing to intercept and nothing to replay.

This is a structural difference from passwords. A fake site can display a login form identical to the real one and capture your credentials. With a passkey, even if the user doesn't notice the deception, authentication silently fails on the technical side. No exploitable information is sent to the fraudulent site.

This protection also works against real-time Adversary-in-the-Middle (AiTM) attacks — attacks that even traditional 2FA cannot stop.

Can my fingerprint be stolen like a password?

No. Your fingerprint (or Face ID) never leaves your device. It doesn't travel over the network and isn't stored on the website's server. It is used solely to unlock the cryptographic key locally — and that key is what performs the authentication.

The site never sees your fingerprint, never receives it, and therefore cannot have it stolen. This is fundamentally different from a password, which is sent to the server at every login and can be compromised if the database is breached.

And if Touch ID or Face ID is unavailable (injured finger, faulty sensor), your device PIN takes over. Biometrics is a convenience, not a dependency.

What happens if I lose my phone or computer?

The answer depends on where your passkeys are stored. If they are synced via iCloud Keychain (Apple) or Google Password Manager, they are automatically available on your other devices within the same ecosystem. Switching to a new iPhone or a different PC using the same Google account is seamless.

However, if a passkey was created locally on a single device only, losing that device means losing access. That's why most services keep the password as a fallback sign-in method during the transition period. A password manager that syncs passkeys across devices and browsers significantly reduces this risk.

Where are my passkeys stored, and who has access to them?

Passkeys are stored by the provider you choose — or that is selected by default — at the time of creation. The main options are iCloud Keychain (Apple), Google Password Manager (Chrome), and third-party password managers.

Each provider has its own sync scope:

iCloud Keychain syncs across all Apple devices, but not beyond
Google Password Manager syncs across all Chrome browsers regardless of OS, but not in Safari
A third-party password manager can work across all devices and browsers

A common pitfall: when creating a passkey, multiple providers may appear at the same time — your password manager extension, your browser, and your operating system. Touch ID, for example, gives the impression that "the Mac is handling this," when in reality it's either Chrome or macOS storing the passkey behind that gesture. If you don't pay attention to the initial choice, you may not be able to find your passkey on another device later.

How do you manage passkeys day to day?

The trickiest part today is management. There is no single place to see all your passkeys. They are spread across different interfaces depending on which provider was chosen at creation.

To find or delete a passkey based on where it's stored:

In Chrome: go to the browser's password settings
On macOS: System Settings, Passwords section
In a third-party manager: inside the vault, in the section dedicated to passkeys

It's possible to unintentionally create multiple passkeys for the same account across different providers. To avoid confusion, the simplest approach is to pick one provider and stick with it. On the service side, reputable sites display a list of registered passkeys for your account along with a revocation option.

Will passkeys replace passwords?

Not immediately, but the direction is clear. Not all sites support passkeys yet, and users must navigate both systems during the transition. Passwords remain a necessary fallback for services that don't yet offer passkeys, or as a recovery method.

Adoption is moving fast: major players (Google, Apple, Microsoft) are integrating passkeys natively into their platforms. Over time, passwords should become the exception rather than the rule. In the meantime, a password manager capable of handling both traditional passwords and passkeys offers the best transition experience.

Key takeaways

A passkey is a cryptographic key tied to your device — more robust and simpler than a password
Passkeys are structurally resistant to phishing: they only work on the exact domain for which they were created
Your fingerprint never leaves your device and cannot be stolen through a website
Choose a single provider to store your passkeys and avoid confusion across devices
Passwords remain necessary as a parallel option during the transition period
A password manager that supports passkeys simplifies multi-device management

Strong authentication goes hand in hand with trustworthy hosting. Discover our approach to security and data sovereignty.