Quick answer
Use a passkey when the account offers one.
A passkey is tied cryptographically to the real website or app, so it cannot be typed into a lookalike phishing page. Use passkeys where available, but continue protecting recovery email, devices, and any fallback password.
How a password works
A password is a shared secret. You know it, the service receives a representation of it during sign-in, and the service stores a verifier derived from it. Because users can type that secret anywhere, phishing sites can steal it. Because people reuse passwords, one breach can affect unrelated accounts.
How a passkey works
A passkey uses a cryptographic key pair. The service stores the public key; your device or passkey provider protects the private key. During sign-in, the service sends a challenge that the private key signs after you approve with a device PIN, fingerprint, face, or another local unlock method. The private key is not sent to the service.
The credential is scoped to the legitimate service. A phishing page on a different domain cannot ask the passkey to authenticate as if it were the real site. FIDO describes passkeys as phishing-resistant credentials that eliminate shared secrets and credential reuse.
Passkey and password tradeoffs
| Question | Passkey | Password |
|---|---|---|
| Phishing | Resistant to lookalike-domain credential theft | Can be typed or autofilled into the wrong place |
| Reuse | Unique key pair per service | People frequently reuse the same secret |
| Storage | Device, platform account, security key, or password manager | Memory, password manager, or unsafe manual storage |
| Recovery | Depends on provider, synced devices, and account recovery | Usually reset through email, phone, support, or recovery codes |
| Compatibility | Growing but not universal | Nearly universal |
Synced and device-bound passkeys
A synced passkey is available through a platform or credential manager on your authorized devices. A device-bound passkey remains on a particular device or hardware security key. Synced credentials are convenient; device-bound credentials can be useful when an organization requires tighter control. The right choice depends on recovery, portability, administration, and threat model.
What passkeys do not solve
- A compromised or unlocked device
- Weak recovery processes that fall back to email or SMS
- Fraud performed after a legitimate sign-in
- Malicious software acting inside an authenticated session
- Confusing account transfers, offboarding, or family recovery
A phishing-resistant login is a major improvement, not a complete security program.
A practical adoption plan
- Start with email and the password manager. These accounts often control recovery elsewhere.
- Add more than one recovery path. Use another authorized device or hardware security key when supported.
- Keep devices protected. Use encryption, screen lock, updates, and remote-loss controls.
- Document fallback credentials. If a password remains, keep it unique and stored safely.
- Test recovery before an emergency. Know how a replacement phone or computer will regain access.
Do you still need a password manager?
Usually, yes. Adoption is incomplete, many accounts retain a fallback password, and managers increasingly store both passwords and passkeys. The manager can also hold recovery codes, identities, and secure notes—although especially sensitive recovery material may deserve a separate protected backup.
Review our password-manager guide for product-selection criteria.