Passkeys vs Passwords: What Changes

After decades of telling people to pick stronger passwords, the industry is quietly trying to retire them. Apple, Google and Microsoft now support passkeys, and more sites add them every month. Here is what a passkey actually is, and what changes for you.

The problem passkeys solve

Passwords have two unfixable weaknesses. First, they are shared secrets — you and the website both know the same string, so a breach of the website leaks it. Second, they are phishable — if an attacker builds a convincing fake login page, you can be tricked into typing the real password into it.

Longer and more random passwords, stored in a manager, fix the first weakness in practice. But they do nothing about phishing, which remains the single most common way accounts are taken over.

How a passkey is different

A passkey is based on public-key cryptography. When you create one, your device generates a pair of keys:

• A private key that never leaves your device (phone, laptop, or a hardware security key).
• A public key that the website stores.

To log in, the website sends a challenge; your device signs it with the private key; the website verifies the signature with the public key. The secret is never transmitted and never stored by the site, so a website breach leaks nothing usable.

Phishing stops working too, because the passkey is bound to the real site's domain. A lookalike phishing page has the wrong domain, so your device simply refuses to sign. You cannot be tricked into "giving away" a passkey the way you can a password.

What it feels like in daily use

In practice, logging in with a passkey means approving with the same thing you already use to unlock your device — a fingerprint, a face scan or a PIN. There is nothing to remember and nothing to type. Passkeys sync through your platform's keychain (iCloud Keychain, Google Password Manager and so on), so a passkey created on your phone can work on your laptop.

The honest trade-offs

Passkeys are not perfect yet:

• Account recovery matters more. If passkeys live only on one device and it is lost, you rely on the sync service or a backup method. Set up more than one.
• Cross-ecosystem use is still maturing. Using an Apple passkey on a Windows machine, or vice versa, usually works via a phone scan but is less seamless than within one ecosystem.
• Not every site supports them. Adoption is growing fast but uneven, so passwords are not going away overnight.

What to do right now

You do not have to wait for passkeys to tidy up your logins:

• Turn on passkeys where important accounts offer them — email, banking and your password manager first.
• For everything still on passwords, use long, random, unique passwords, one per site, kept in a manager. Length matters far more than swapping letters for symbols; a long passphrase of random words is both strong and memorable.
• Keep two-factor authentication on wherever passkeys are not yet available.

The direction of travel is clear: a login that cannot be phished and cannot be leaked in a database breach is simply better than one that can be both. Passkeys are not quite universal, but the groundwork you lay now — strong unique passwords, a good manager, 2FA — is exactly what keeps you safe during the transition. Checking how an attacker would score your current passwords, and generating long random replacements or a word-based passphrase, are a sensible first hour's work, and everything runs locally so no password you test ever leaves your browser.