Logging into something shouldn't feel like a small security ritual. Yet here we are: type a password, wait for a text, copy the code, hope it arrives. Passkeys are the industry's attempt to bin most of that. They're already sitting on the phone in your pocket and the laptop on your desk, whether you've noticed or not. Before you hand over your most important accounts, though, it's worth knowing what you're actually agreeing to — especially what happens when a device goes missing.

How a passkey actually works

When you create a passkey, your device generates a pair of mathematically linked keys. One is private and stays where it was made: inside your phone's secure hardware, your laptop's security chip, or the encrypted vault of a password manager. The other is public, and the website stores it. That's the whole trick. There's no shared secret travelling back and forth, and nothing useful for an attacker to steal from the site's servers.

Signing in runs in the opposite direction. The site sends a challenge, your device asks you to confirm it's really you with a fingerprint, face scan or PIN, and then uses the private key to sign that challenge. The site checks the signature against the public key it holds. Your biometric data never leaves the device — it's a local gate, not something transmitted to a server.

Synced passkeys and device-bound passkeys

The difference matters more than most explainers admit. A synced passkey travels with your account — through iCloud Keychain, Google Password Manager, a Microsoft account or a third-party password manager — so a replacement phone can pick it up. A device-bound passkey stays on one piece of hardware, such as a security key on your keyring. The second is harder to clone but unrecoverable if it's lost. Most people end up with a mix of both.

Why passkeys are harder to phish

A passkey is tied to the exact address of the site it was created for. Land on a lookalike page with a slightly wrong domain and your browser won't offer the passkey at all, because the private key can't be talked into signing anything for a site it doesn't recognise. Compare that with the password-and-text-message routine, where a convincing fake page can harvest both the password and the one-time code in real time.

The second gain is quieter. Because websites never hold a shared secret for you, a breach of their database doesn't hand criminals a list of credentials to replay on other services. Credential stuffing — trying leaked email and password pairs across dozens of sites — stops working when there's nothing reusable to leak.

None of this makes an account untouchable. Malware on your device, someone who has your unlocked phone, or a careless account-recovery process can all still cause damage. Passkeys close the front door; they don't patrol the house.

Passkeys and passwords, side by side

• Signing in: a glance or a fingerprint, instead of typing a password and waiting for a code.
• What the site stores: a public key, rather than a hashed password.
• What a breach leaks: nothing directly reusable, instead of credentials that work elsewhere.
• What a phishing page gets: nothing, rather than your password and possibly a one-time code.
• If you lose your device: recovery through your password manager or another registered device, rather than an emailed reset link.

That last point is the one people underestimate. Passwords are terrible, but resetting one is a well-worn path. Passkey recovery depends on whichever ecosystem you chose, and several routes lean on your email account — which makes your inbox the single most valuable thing you own online.

The awkward parts nobody mentions

• Not every service supports passkeys yet, so you'll be keeping a password for some accounts for a while.
• Shared logins are messy. A passkey belongs to a person and a device, which doesn't suit a household streaming account or a shared work tool.
• Some sites keep a password as a fallback. If that route stays open, so does the weakness it creates.
• Signing in on someone else's computer usually means scanning a QR code and confirming your phone is nearby. It works well, but it feels strange the first few times.
• Older workplace systems and niche software can lag behind consumer apps by years.

How to try one without locking yourself out

1. Pick a low-stakes account — a retailer, a delivery app — rather than your bank or your email.
2. Check you have a password manager or platform keychain set up, and that you know its master password. That vault is now part of your login chain.
3. Create the passkey, then sign out and back in to prove it works.
4. Leave the password in place for now, and keep two-factor authentication switched on until you're confident.
5. Add a second device, or a hardware security key, to your most important account — usually email.
6. Update your recovery email address and phone number before you need them. Out-of-date recovery details cause far more lockouts than forgotten passkeys.

The practical answer: switch gradually

For most people, the sensible move is to enable passkeys wherever they're offered, starting with the account that could unravel everything else if it were compromised: your email. Test the recovery route while things are calm. Keep the password as a backup until you've signed in successfully a few times, and don't remove it on a site that hasn't given you another way back in.

If a bank or building society is involved, follow its own instructions rather than general advice — it will know exactly how its recovery process works, and financial institutions often keep alternative sign-in methods for sound reasons.

Passwords aren't disappearing overnight, and you don't need to force the change. But every account you move to a passkey is one fewer password to reuse, one fewer code to wait for, and one fewer thing for a phishing page to take. Start with one this week and see how it feels.

Photo: u_h0yvbj97 / Pixabay