Passkeys Are Quietly Replacing Your Passwords. Here’s What Actually Changes

Most people still sign in to the internet the same way they did twenty years ago, with a password they made up, forgot, reset and then reused somewhere else. That habit is the single biggest reason accounts get taken over. A newer system called passkeys is now built into most phones, laptops and browsers, and a growing list of banks, shopping sites and email services will let you use one today. The change is real, but it is also confusing, because passkeys and password managers arrive in the same settings menus and often under the same names.

We spent two weeks setting up passkeys across a dozen accounts on three phones and two laptops, and asked security researchers and IT staff what they tell their own families. Here is what passkeys are, how they relate to the password manager you may already use, and what to do this weekend.

Why passwords keep failing

Passwords fail for two reasons, and neither is really the user’s fault. The first is reuse. The average person has well over a hundred online accounts, and almost nobody can remember a unique, long password for each one. So people reuse a few favorites with small variations. When any one site is breached, criminals take the leaked email and password pairs and try them everywhere else, a technique known as credential stuffing. It is automated, cheap and depressingly effective.

The second reason is phishing. A convincing fake sign-in page can capture a password as easily as the real one, and even careful people get tricked when a message arrives at the wrong moment. “I have watched engineers with twenty years of experience type their password into a fake page because the email looked like it came from payroll,” said Denise Harlow, who runs security training for a regional hospital network in Columbus, Ohio. “It is not about being smart. It is about being busy.”

What a password manager does

A password manager is an app that creates and stores a different, random password for every site, then fills it in for you. You remember one strong master password, and the app remembers the rest. Most phones and browsers now include a basic one, and several independent apps offer more features, such as sharing passwords with family members or warning you when a saved password shows up in a known breach.

Password managers solve the reuse problem almost completely. They also help with phishing in a quieter way: because the app only fills a password on the exact web address where it was saved, it will refuse to fill your bank password on a lookalike site. If your manager suddenly does not offer to fill, treat that as a warning, not a glitch.

What a passkey is, in plain terms

A passkey replaces the password entirely. When you create one for a site, your device makes a pair of matching digital keys. One stays locked on your device, protected by your fingerprint, face or screen PIN. The other is stored by the website. When you sign in, the site sends a one-time challenge, your device answers it with the private key after you unlock it, and the site checks the answer with its public half.

Three things follow from that design, and they explain why security people are excited:

• There is nothing to steal from the website. A site breach exposes only public keys, which are useless to an attacker.
• There is nothing to type into a fake page. A passkey is tied to the real site’s address, so a phishing page simply cannot ask for it.
• There is nothing to remember. You unlock your phone the way you already do dozens of times a day.

Passkeys usually sync between your own devices through the same account that backs up your phone, so a passkey created on your phone can also work on your laptop. You can also sign in on a borrowed computer by scanning a QR code with your phone, which keeps the key on your device.

The best security upgrade is the one people actually use. Passkeys are the first one I have seen my parents adopt without a phone call to me.

Marcus Bell, IT director at a Denver school district

Where it still gets messy

Passkeys are not finished, and pretending otherwise does readers no favors. In our testing, the setup button was buried in a different place on almost every site, usually under “security” or “sign-in options” rather than on the main account page. Two sites created a passkey but still asked for a text-message code afterward. One shopping site let us add a passkey on a phone but would not offer it on the same account in a desktop browser.

Moving between ecosystems is the bigger issue. If you use a phone from one maker and a laptop from another, your passkeys may not sync between them automatically. Some independent password managers can now store passkeys too, which helps people with mixed devices, and an industry standard for transferring passkeys between apps is rolling out slowly. Until it is everywhere, expect a few sites where you will keep a password as a backup.

Then there is recovery. If your only device is lost and you have no backup, getting back into accounts can be slow. That is not a reason to avoid passkeys. It is a reason to set up recovery options before you need them.

A weekend plan that takes about an hour

You do not need to convert every account at once. Security staff we spoke with recommended starting with the accounts that would hurt most if someone else got in.

Step one: pick a password manager and use it

If you already use the one built into your phone or browser, that is fine. If you have a mix of devices, an independent manager that works everywhere may be easier. Choose a long master passphrase, four or five unrelated words, and do not use it anywhere else.

Step two: add passkeys to your most important accounts

Start with your primary email, since it can reset almost everything else. Then your bank, your phone carrier account and any account that stores a payment card. Look under security settings for “passkeys” or “sign in with your device.” Keep the existing password stored in your manager for now.

Step three: lock down recovery

Print any backup or recovery codes and store them with your passport or other important papers. Add a trusted recovery contact if the service offers one. Make sure your phone itself has a strong PIN, at least six digits, because your phone is now the key to everything.

Step four: fix the weak spots

Run your password manager’s security check. It will list reused and breached passwords. Change the worst ones, starting with any password you also used on your email account.

What to tell the rest of the family

For older relatives, the pitch is simple: you will unlock the account the same way you unlock the phone, and nobody can trick you into reading it out over the phone. Harlow said she sets up passkeys for her parents on their email and bank, and leaves everything else for later. “Two accounts done well beats forty accounts half done,” she said.

Passwords are not disappearing next month, and a good password manager remains the right tool for the many sites that have not caught up. But for the accounts that matter most, the switch is ready, and it takes less time than resetting a forgotten password. If you hit a site that makes passkeys hard to find, tell us about it. We are keeping a running list and will update this guide.