Type your email. Type a password. Wait for a six-digit code that arrives just slowly enough to be annoying. Then repeat the ritual on Monday, because the site has forgotten you again. Passwords have been the default for decades, and most of us have quietly accepted the friction: the resets, the reused variations, the login pages that look almost right.

Passkeys are the first replacement with broad industry support behind them. Apple, Google and Microsoft ship them, the major password managers handle them, and more sites offer them at login each month. Support isn't the same as understanding, though. Here's what a passkey actually is, where it lives, and what you give up when you adopt one.

What a passkey actually is

A passkey is a pair of cryptographic keys: one private, one public. The private key stays on the device or in the account that created it. The public key goes to the website, and that is all the site stores.

When you sign in, the site sends a challenge. Your device signs it with the private key, and the site checks that signature against the public key it already holds. Two things follow from that design. There is no shared secret sitting in the website's database for an attacker to steal, and the credential is bound to one specific domain, so a convincing fake page at a similar address has nothing to work with.

Your fingerprint or face unlock doesn't travel anywhere. It only unlocks the private key locally, the way it unlocks your phone.

Signing in, step by step

Setting up a passkey is a one-time job. The flow usually looks like this:

1. Sign in to the site the way you always have — password, or password plus a code.
2. Open security settings and choose to add a passkey.
3. Approve the prompt with Face ID, your fingerprint or your device PIN.
4. The key pair is generated. The public half goes to the site; the private half stays with you.

After that, logging in is short: enter your username if the site asks for it, approve the prompt, and you're in. Some sites skip the username entirely, because your device tells the site which passkey to use.

Where passkeys live — and why it matters

A passkey has to be stored somewhere, and that choice shapes your recovery options. There are three realistic homes:

• Your platform account. iCloud Keychain on Apple devices, Google Password Manager on Android and Chrome. Passkeys sync across devices signed into the same account, which is convenient and usually well protected — but they sync inside that ecosystem.
• A third-party password manager. 1Password, Bitwarden, Dashlane and others now store passkeys and sync them across platforms. Handy if you mix iPhone, Windows and Linux.
• A hardware security key. A small USB or NFC device. Nothing syncs, so you'll want a spare kept somewhere safe. The upside is that no cloud account stands between you and your logins.

If you add a passkey to your Google account through iCloud Keychain, understand what happens when you change phones. Whichever route you take, add a second passkey on a different device or store before you remove your password.

Why passkeys are harder to attack

A leaked password database is dangerous. A leaked store of public keys is not. Phishing pages that harvest passwords fail against passkeys, because the signature only works for the real domain. There's nothing to memorise, so there's no reuse across sites and no predictable variation to guess. And logging in is simply faster than typing a long password and waiting for a code.

The honest trade-offs

Sharing is awkward

Passkeys are personal by design. A shared streaming login, a team social account or a family utility bill doesn't fit neatly. Password managers offer vault sharing, but you can't read a passkey off a screen and text it to someone.

Ecosystem friction remains

Syncing mostly works inside one vendor's world. Move between Apple and Android, or sign in on an older work laptop, and you may fall back to a password and a code. Cross-device sign-in by scanning a QR code with your phone helps, but it's an extra step.

Recovery needs planning

A passkey can't be emailed to you as a reset link. Recovery depends on the site and the store you chose, and it's worth testing before you need it. Losing every device and every recovery option is the scenario to design against.

Support is uneven

Consumer services have moved quickly. Banks, government portals and niche business software are often slower, sometimes for sound regulatory reasons.

So do you still need a password?

For now, yes. Many accounts keep a password as a fallback, and plenty of sites only offer passkeys alongside one. Keep your password manager, keep unique passwords where passkeys aren't available, and keep multi-factor authentication switched on where it is. Don't delete a password the day you create a passkey — wait until you have two working passkeys and a tested recovery route.

How to start this week

1. Begin with your primary email account. It's the recovery hub for almost everything else.
2. Set up a passkey inside your password manager's own account first, so a lost device doesn't lock you out of the vault.
3. Add passkeys at three or four high-value sites: email, banking, cloud storage, your main social account.
4. Register a second passkey on another device, or buy a hardware key as your backup.
5. Save recovery codes offline — printed and in a drawer, not inside the same account.
6. Leave the password in place until the site lets you remove it and you trust your recovery options.

A sensible way to move forward

Passkeys aren't a leap of faith, and they don't ask you to change everything at once. Treat them as an upgrade you apply account by account, starting with the ones that would hurt most to lose. If you manage accounts for a team, test the rollout on a small group, make sure your helpdesk knows the recovery paths, and keep a documented fallback for anyone who loses a device.

The goal isn't to eliminate passwords overnight. It's to stop depending on them where a better option already exists — and to know exactly what you've kept as a backup when you make the switch.

Photo: LYRL / Pixabay