Passkey vs Password: What Changes When You Stop Typing Secrets

The passkey vs password question sounds like a matter of convenience, but the real difference sits somewhere else. A password is a secret you type. A passkey is a key you cannot type at all. That single property is why the federal cybersecurity agency CISA counts this kind of sign-in as the only widely available phishing-resistant option. If you have signed in to Google, Amazon or PayPal lately, you have seen the prompt: create a passkey, skip the password next time. Most people tap “Not now”.

That reaction is understandable. The pitch on most vendor pages is frictionless and slightly breathless, and it rarely answers the questions people actually ask. What happens if the phone goes into a lake? Who holds these keys? And can you ever leave Apple for Android without rebuilding every login? This piece covers what a passkey is, why phishing fails against it, and those less comfortable questions.

What is a passkey?

A password is a shared secret. You know it, and the website keeps a scrambled copy. Every time you sign in, you send the secret over, and the server checks it against its copy. The design has a built-in flaw. Anything you can send can also be sent by someone who caught it once.

Passkeys reverse that arrangement. When you set one up, your device creates a pair of mathematically linked keys. The private key stays with you, on your phone, your laptop or inside your password manager. The public key goes to the website. At sign-in, the server sends a random challenge that only the private key can answer. Your device answers it, the server checks the answer with the public key, and the private key never leaves your hands.

Before your phone answers, it wants to know that you are you. So you use whatever already unlocks the device, a fingerprint, a face scan or a PIN. That is the step most people think of as “signing in with a passkey”. Your fingerprint does not travel anywhere, though. Google’s help pages state that biometric data stays on the device and is never shared with Google. The fingerprint only unlocks your own key.

The idea is not new. Apple, Google and Microsoft jointly committed to it on May 5, 2022, building on standards from the FIDO Alliance, an industry group that writes sign-in specifications, and the web standard WebAuthn. By May 2026 the FIDO Alliance estimated that around five billion passkeys were in use. In a survey it published at the same time, covering 11,000 consumers in ten countries, 75 percent said they had turned on a passkey for at least one account.

Why phishing fails against a passkey

The real improvement hides in a detail you never see. Every passkey is bound to the web address it was created for. Your passkey for paypal.com does not exist, as far as your device is concerned, on paypal-account-help.com or on a page that copies the real one down to the last pixel. The device checks the address itself before it responds. On a fake page, there is simply nothing to type and nothing to approve.

The clearest demonstration of what that is worth came in the summer of 2022. On July 20, at 22:50 UTC, at least 76 employees of the internet company Cloudflare received text messages within less than a minute, some of them on personal phones and some sent to family members. The link pointed to cloudflare-okta.com, a domain registered under 40 minutes earlier. Waiting there was a flawless copy of the company’s internal sign-in page.

It asked for a username, a password and then the six-digit code from an authenticator app. Everything typed into it went straight to the attackers over the messaging app Telegram, so they could replay it on the real page while the code was still valid. A near-identical campaign hit the communications company Twilio around the same time, and Twilio disclosed in early August 2022 that attackers had gotten in.

At Cloudflare, three employees fell for the message and entered their credentials. Nothing happened. Every employee carried a hardware security key built on FIDO2, the same technology passkeys rest on, and those keys refused to answer a domain they had never been registered with. The attackers held valid passwords and still could not get past the key. Cloudflare wrote afterwards that it had not seen a successful phishing attack since rolling the keys out.

US agencies have drawn the same conclusion. CISA, the federal cybersecurity agency, wrote in an October 2022 fact sheet that the only widely available phishing-resistant authentication is FIDO/WebAuthn. NIST, the standards body whose digital identity guidelines shape federal sign-in rules, finalized a new version of those rules in July 2025. It now has a dedicated appendix for syncable authenticators, the official term for passkeys that sync across devices.

There is a second benefit, and it shows up when a company gets breached. Leaked databases usually contain usernames and password hashes, and anyone who reused that password elsewhere is suddenly exposed. A server that only knows passkeys stores only public keys. An attacker gains nothing from them, because they were designed to be public in the first place. If you want to know whether your address already sits in a leaked list, you can check it without exposing anything new.

Passkey vs password: side by side

Where passkeys work today

The large platforms have moved, each at its own speed. Microsoft has let consumers delete the password from a personal Microsoft account since September 2021, and since May 2025 new Microsoft accounts are passwordless by default. Google made passkeys the default sign-in option for personal Google accounts on October 10, 2023. Amazon switched them on for its website and iPhone app in October 2023. WhatsApp followed on Android that same month and on the iPhone in April 2024.

The setup follows a similar pattern almost everywhere. Somewhere in the account’s security settings there is an entry like “Passkeys” or “Sign-in options”. You tap it, your device asks for your fingerprint or PIN, and you are done. The next time you sign in, the login field offers the passkey on its own. Nobody needs a separate manual for every service, the whole thing usually takes under a minute.

Work and school accounts can behave differently. Google notes, for example, that for Workspace accounts the administrator decides whether a passkey may replace the password or only serves as a second step.

You lost your phone. Now what?

This is the first thing almost everyone asks, and the answer depends on where your passkeys live. In most cases they are synced, meaning they are spread across your devices in encrypted form through one account. On the iPhone that is iCloud Keychain. On Android it is usually Google Password Manager, and third-party password managers do the same job on both.

Apple describes iCloud Keychain as end-to-end encrypted with keys that Apple does not know. According to Apple, passkeys can be recovered even if you lose every device at once. Google handles it differently. On a new Android phone you sign in to your Google account and also enter the screen lock PIN, pattern or password of one of your old devices. Only both together open the vault.

The risky case is a key that was never synced. That mostly means hardware security keys, the small USB or NFC tokens that lock the private key inside themselves. Lose the token and the passkey on it is gone. What remains is each service’s own recovery path, a backup email, a phone number or a second key registered in advance. Anyone relying on a single token should register a spare before they need it.

Who actually holds your keys

This is the part marketing tends to skip. Storing your passkeys in iCloud Keychain or with Google means putting a lot of keys in one basket. The encryption is solid, and both companies have layered protections around recovery. In the end, though, every passkey is only as safe as the account that syncs it. A weak Apple Account password without a second factor is a poor foundation for a keychain full of passkeys.

The technology is not untouchable either. In August 2026, researchers at Unit 42, the threat research team of Palo Alto Networks, described attacks on Google’s passkey sync system. All of them start from the same place, malware already running on the victim’s computer. In the worst scenario they described, every synced passkey could be pulled out. That is serious. It also moves the problem to where it has always been for passwords, because an infected computer is game over for any sign-in method.

Can you move passkeys between Apple and Android?

For years this was the strongest argument against passkeys. Passwords could always be exported somehow, at worst as a plain spreadsheet. Passkeys were stuck where they were created. Switching from iPhone to Android meant creating every passkey again on the new device.

A standard for this now exists. In October 2024 the FIDO Alliance published two draft specifications, the Credential Exchange Protocol and a matching data format. Together they let passwords and passkeys travel encrypted directly from one app to another, with no file in between. Apple built this into iOS 26 and macOS 26 and says passkeys can now move securely between participating password apps. Google brought the same idea to Android. Since September 10, 2026, according to Google, transfers work between Google Password Manager, 1Password, Bitwarden and Dashlane, with more partners to come.

Note the limits. Both implementations move data between apps on the same device. Someone leaving an iPhone for an Android phone still needs a stop in between, a password manager that runs on both systems and supports the standard. On the iPhone, the passkeys go into that app, and on the new phone they show up through its sync. Whether a given app already supports this is listed in its own help pages, and older operating system versions are left out.

The password often stays behind

A passkey does not replace the password on every service. Often it just sits next to it. Google’s own help says that adding a passkey does not change or remove any existing sign-in or recovery method. The password stays valid, and anyone who types it into a fake page still opens the door.

For phishing protection, that is a real compromise. An attacker does not need to beat your passkey if a second door stands open beside it. Some services let you close that door. A personal Microsoft account can drop its password entirely, and has been able to since 2021. Many others do not offer this yet, and there the old password still has to be long, unique and stored somewhere sensible.

Signing in on someone else’s computer

What about the library computer or your sister’s laptop? Creating a passkey there would be a mistake, since the machine is not yours. For this case there is sign-in by QR code. The website shows a code, you scan it with your phone and approve on the phone with your fingerprint. Both devices need Bluetooth switched on.

The Bluetooth has a job. It checks that the phone is physically near the computer. A scammer who emails you a QR code from the other side of the world gets nowhere with it. After you are in, nothing stays behind on the borrowed machine except the session itself, which you should end by signing out.

Where it still falls short

A lot has improved. It is not perfect. Families and emergencies are one weak spot. A password can be written down and left in a folder for your next of kin, and a passkey cannot. Apple has allowed sharing passwords and passkeys with a trusted group since iOS 17, but only with people who also use a current Apple device. In a household with mixed phones that does not help much.

Older hardware also drops out. Google lists Android 9, iOS 16 or Windows 10 as minimums, plus a reasonably current browser. The wording is inconsistent too. Some services call passkeys security keys, and some ask where to save the key without explaining what the options mean. None of that is dangerous, but it is a big reason people tap “Not now”.

A sensible place to start

Nobody has to convert every account in one evening. Email is the best first candidate, because nearly every other password can be reset through your inbox. Whoever controls the inbox controls everything attached to it. After that come the accounts that move money or hold private messages.

Before creating the first passkey, look at the account that will store it. Your Apple Account or Google account should have its own second factor, and the recovery phone number on file should still be yours. A second device you can sign in from in an emergency is worth having too. A passkey on a poorly protected sync account is a good lock on a cardboard door.

And where a service allows it, turn the old password off, or at least keep it in good shape. A site that accepts both is only as strong as the weaker way in.

What is left

Passwords have a basic problem that no rule about length or special characters can fix. They can be handed over, including to the wrong address. A passkey cannot be handed over. It answers only the real service and keeps its private half with you, which makes it close to immune to the most common attack on the internet.

The open questions are mostly about everything around it, meaning storage, loss and moving house. The answers are far better than they were two years ago, even if switching between the Apple and Google worlds still takes some manual work. Secure your sync account, start with your email, and the rest follows at whatever pace suits you.

Frequently asked questions

What is a passkey, in plain terms?

A passkey is a digital key for one specific account. When you create it, your device generates two linked pieces: a private one that stays with you and a public one that the website stores. To sign in, your device proves it holds the private piece without ever handing it over, and you approve that with your fingerprint, your face or your screen lock PIN. There is no secret to type, remember or give away.

Is a passkey safer than a password with two-factor authentication?

Against phishing, clearly yes. A text message code or an authenticator app code can be typed into a fake page and relayed to the attacker within seconds. A passkey only works on the exact web address it was created for, so on a lookalike site your device simply has nothing to offer. Against malware already running on your own computer, a passkey helps less, just like every other sign-in method.

What happens to my passkeys if I lose my phone?

If they were synced through iCloud Keychain, Google Password Manager or another password manager, they come back when you sign in to that account on a new device. Google additionally asks for the screen lock of one of your old devices or your password manager PIN. A passkey that lived only on the lost device or on a single hardware security key is gone, and you fall back on the recovery options of each individual service.

Can I move passkeys from iPhone to Android?

Increasingly, yes. Apple added a standard way to transfer passkeys between participating password apps in iOS 26, and Google added the same on Android in 2026 for Google Password Manager, 1Password, Bitwarden and Dashlane. Both work between apps on one platform, so the practical route between iPhone and Android usually runs through a password manager that exists on both and syncs your passkeys across.

Do passkeys replace passwords completely?

Not on every service. Many sites add the passkey as an extra way in and keep your old password active, and Google says that creating a passkey does not remove any existing sign-in or recovery method. Some services, Microsoft accounts among them, let you delete the password entirely. Where that is not possible, the old password still needs to be strong and unique, because it remains a door a phisher can try.