This matters because it directly closes off two of the biggest ways people get hacked. Firstly, passkeys can’t be phished. Since a passkey is cryptographically tied to the genuine website it was created for, a fake lookalike site simply can’t trick your device into handing over a usable credential, the way a convincing fake email can trick you into typing in your real password. Secondly, passkeys can’t be stolen in a data breach. When a company’s database gets hacked, there’s no password sitting in a file for criminals to steal, because your actual key was never stored on their system in the first place, only the public half, which is useless to a criminal on its own.
The genuine issues worth knowing about
Passkeys are a real, meaningful security improvement, but they’re not entirely without their complications, and it’s worth going in with your eyes open.
Losing your device is the biggest risk. If your passkeys are “synced,” backed up through iCloud Keychain on Apple devices, Google Password Manager on Android, or a password manager like 1Password or Bitwarden, they’ll automatically restore when you sign into a new device. But if a passkey is “device-bound,” meaning it only ever lived on that one phone or laptop, losing that device without a backup can mean genuine trouble getting back into your account.
Account recovery remains the weak point. If you ever do lose every device holding your passkeys, with no backup in place, you’ll generally fall back on the same recovery process as before, usually a code or link sent to your email. This means your email account genuinely deserves your strongest possible protection, since it effectively becomes the master key to everything else if your passkeys are ever unavailable.
Not every website supports them yet. While major banks, email providers and tech platforms have widely adopted passkeys, plenty of smaller sites still rely on passwords only, so most of us will be juggling both systems for some time yet.
Moving between Apple and Google can be clumsy. If you use an iPhone but also a Windows laptop, or switch from Android to Apple down the track, passkeys don’t always transfer smoothly between different companies’ systems, which can be a genuine source of frustration.
The most important piece of advice
Given all this, the single most useful thing you can do is test your recovery process before you delete any of your existing passwords. Set up the passkey, sign out, then deliberately try signing back in on a second device to confirm it genuinely works and that you know how you’d get back in if your phone were ever lost or broken. Only once you’ve confirmed that should you consider removing the old password as a backup.
Should you bother setting them up?
For most people, yes, it’s genuinely worth it, particularly for your most important accounts: email, online banking, and anywhere storing sensitive personal information. Start there rather than trying to convert every single account you own at once. Given how often passwords get reused, written down, or fall for a convincing scam email, a passkey is a real, practical step toward making your most important accounts considerably harder for a scammer to break into.