Somewhere right now, a person is logging into their bank with a password that also unlocks their email, their cloud storage, and a forum they signed up for in 2014. That single reused credential is still one of the most common ways accounts get taken over, and it is the reason the industry has spent the last few years trying to replace passwords altogether. The question is no longer whether passwords are going away. It is what you should be doing with your logins this year, while both old and new systems are still in use.
Two technologies sit at the center of that decision. Password managers have been the sensible answer for over a decade: a vault that generates, stores, and fills unique passwords for every site. Passkeys are newer, built on public-key cryptography, and supported natively by Apple, Google, Microsoft, and a growing list of major services. Marketing for each often implies the other is obsolete. In practice, they solve overlapping but different problems, and most people will end up using both.
This guide explains how each works, where each one fails, and how to choose a setup that fits your actual life. We will walk through a worked example with real numbers, compare the main options in a table, and give you a step-by-step migration path you can follow in an afternoon. If you read nothing else, the summary below covers the decisions that matter most.
Key Takeaways
- Passkeys eliminate phishable passwords for supported sites, but they are only as portable as the platform holding them.
- A password manager is still the best tool for the long tail of sites that do not support passkeys yet, and for storing secure notes, recovery codes, and credit card data.
- Most people should use a password manager as the primary vault and let it store passkeys too, rather than locking themselves into one ecosystem.
- Your master password and account recovery path are now your weakest link. Harden them before anything else.
- Migrate in stages: start with high-value accounts (email, banking, cloud storage) and work outward over two to four weeks.
- Keep at least one independent backup of your vault and at least two ways to recover each critical account.
What Is a Passkey, Really?
A passkey is a cryptographic key pair tied to a specific website or app. When you register, your device generates a private key and keeps it locked behind your fingerprint, face, or device PIN. The website stores only the public key. When you sign in, the site sends a challenge, your device signs it with the private key, and the site verifies the signature. No shared secret ever travels across the network, and nothing you type can be captured by a fake login page.
That last property is the important one. Passkeys are bound to the origin domain by the browser and operating system, so a phishing site at examp1e.com cannot request a signature meant for example.com. This is why passkeys are considered phishing-resistant in a way that even good password managers, which rely on your attention to notice a wrong domain, are not.
Where passkeys are stored
Passkeys live in one of three places, and this is the source of most confusion:
- Platform passkeys are stored in your phone or computer's keychain (iCloud Keychain, Google Password Manager, Windows Hello).
- Synced passkeys are platform passkeys replicated across your devices through the vendor's cloud account.
- Hardware security keys such as YubiKey store the private key on a physical device you carry.
Each option trades convenience against portability and recovery. A hardware key is the most secure but gets lost. A cloud-synced passkey is effortless but ties you to one vendor's ecosystem.
What a Password Manager Does Well (and Where It Falls Short)
A password manager is a vault that encrypts your data with a key derived from a master password, usually through a function like PBKDF2, Argon2, or scrypt. It generates long random passwords, fills them into forms, flags reused credentials, and increasingly stores passkeys, TOTP codes, and secure notes too. Modern managers are good at this. The main risks are not cryptographic. They are behavioral and structural.
The biggest structural risk is the master password. If someone learns it, they have everything. The second is the recovery path: a forgotten master password with no recovery method means permanent lockout. The third is the attack surface of your browser extension and the phone app, which the ETH Zürich research discussed in our piece on password manager security risks and vault hardening examined in detail. The lesson from that work is not that managers are broken. It is that vault configuration and device hygiene matter as much as the product you pick.
Password managers also remain necessary for things passkeys cannot hold: Wi-Fi passwords, software license keys, API tokens, SSH credentials, bank account numbers, and the thousands of sites that still only accept a password. Passkey adoption is accelerating, but the long tail is long.
Passkeys vs Password Managers: The Comparison
The table below compares the main options on criteria that actually affect daily use. Ratings are relative and reflect typical configurations as of 2026.
| Criteria | Platform passkeys (iCloud / Google / Windows Hello) | Cross-platform password manager (1Password, Bitwarden, Dashlane) | Hardware security key (YubiKey) | Browser built-in password saving |
|---|---|---|---|---|
| Phishing resistance | Very high | High (depends on user noticing domain) | Very high | Moderate |
| Works with non-passkey sites | No | Yes | Only with supported sites | Yes |
| Cross-ecosystem portability | Limited to vendor ecosystem | Strong (most platforms) | High (physical, portable) | Limited |
| Recovery if device is lost | Good if cloud account is secure | Good with recovery kit or account recovery | Poor unless you own a backup key | Depends on browser account |
| Stores non-login secrets (notes, keys, cards) | No | Yes | No | Limited |
| Ease of daily use | Excellent | Excellent | Good (requires a physical tap) | Good |
The pattern is clear. Platform passkeys win on phishing resistance and convenience but lose on breadth and portability. A dedicated password manager wins on breadth and portability and is only slightly behind on phishing resistance if you use it carefully. Hardware keys are the strongest for your most important accounts but are the worst for recovery if you own only one.
A Worked Example: Restructuring 47 Logins
Consider a realistic case. Priya is a freelance designer who uses 47 accounts across 12 core services: Google, Apple ID, her bank, two credit cards, a tax portal, Dropbox, GitHub, Figma, a stock photo site, a client invoicing tool, a newsletter platform, and a forum. Before any changes, she has 31 unique passwords, 9 that are reused across two or more sites, and 7 that are years old. Her browser has saved about 40 of them, scattered across two browsers and a phone.
Here is how she restructures the setup over three weeks:
- Week 1, audit. She exports her browser passwords, runs the built-in breach report in her manager, and sorts accounts into three buckets: passkey-capable (Google, Apple, GitHub, Dropbox, Microsoft), password-only (the bank, tax portal, forum, and most smaller tools), and dormant (accounts she no longer uses, which she deletes).
- Week 1, harden the vault. She sets a 6-word passphrase as her master password, enables a second factor on the vault itself, and generates a printed recovery kit stored in a fireproof box.
- Week 2, passkeys for the big accounts. She registers passkeys on Google, Apple ID, and GitHub. For Google she enables synced passkeys in her password manager and keeps one hardware key as a backup, stored in a different location.
- Week 2, rotate the reused and old passwords. The nine reused passwords become nine unique generated ones. The seven ancient ones get rotated, prioritizing the bank and tax portal.
- Week 3, clean up. She removes browser-saved passwords from her phone, turns off browser autofill for banking, and sets a calendar reminder to review the breach report every quarter.
Her result: 11 accounts now use passkeys, 36 use unique passwords in her vault, zero are reused, and her vault holds two recovery paths for everything critical. Time investment was roughly six hours spread over three weeks. The biggest single gain was not the passkeys. It was eliminating the reused passwords, which had been the actual route an attacker would have used.
Which Setup Should You Choose?
The right answer depends on how many ecosystems you live in and how much you value portability. The following profiles cover most readers.
If you live in one ecosystem
If you use an iPhone, Mac, and iCloud across the board, or an Android phone with a Chrome and Google account, platform passkeys plus the built-in password manager may be enough for passkey-capable sites. You will still need a separate tool or notes system for non-login secrets and for logins on other devices. Be honest with yourself about how often you use a Windows PC or a Linux machine.
If you use multiple platforms
A dedicated cross-platform password manager is the better primary vault. It stores passkeys alongside passwords, works across browsers and operating systems, and gives you a single place for everything else. This is the setup most professionals end up with.
If you are a high-value target
Journalists, executives, developers with production access, and anyone managing financial accounts for others should combine a password manager with at least two hardware keys, registered on every account that accepts them. Keep one key on your person and one somewhere safe. This is the only setup that holds up well against targeted phishing.
If you are running a business
Organizational accounts need admin controls, audit logs, and offboarding workflows that consumer tools lack. Passkeys can be enforced through your identity provider, and your password manager should support shared vaults with role-based access. This is also where service-level security matters: our guide on how to audit a site a security plugin already vouched for shows why trust in any single tool should be verified rather than assumed.
Recovery: The Part Everyone Skips
Every authentication system has a recovery path, and attackers know it. Account recovery via SMS, email reset, or support tickets is often the weakest link in an otherwise strong setup. When you adopt passkeys, check what the site does if you lose every device. Some services let you add a second passkey on another device, some require a
Cover image: Phone security by Ervins Strauhmanis, licensed under BY 2.0 via Openverse.
