Passkeys vs Passwords: What Actually Changes

You have probably been offered one by now — a prompt asking whether you would like to sign in with your face or fingerprint instead of a password, and describing it as a passkey.

It is not simply a nicer way to type a password. It is a different mechanism, and understanding the difference is what tells you whether to accept the prompt.

The actual difference

A password is a shared secret. You know it, the service stores a version of it, and anyone who obtains it — by phishing you, by breaching them, or by guessing — can log in as you. Every problem passwords have follows from that one property.

A passkey is a key pair. When you create one, your device generates two mathematically linked keys. The public one goes to the service. The private one stays on your device and is never transmitted, not at sign-up and not at login.

To log in, the service sends a challenge. Your device signs it with the private key. The service verifies the signature against the public key it holds. Nothing reusable ever crosses the network.

The fingerprint or face scan is not the passkey, incidentally. It is how your device decides to unlock the private key it already holds. Your biometrics never leave the device either.

Three problems this removes

Phishing stops working

This is the big one. A passkey is bound to the domain it was created for. On a convincing fake login page, the passkey simply will not offer itself — not because it detects a fraud, but because the site asking is not the site the key belongs to.

That is a structural defence rather than a behavioural one. It does not depend on you noticing a misspelt address while distracted, which is precisely the condition under which people get caught.

Reuse becomes impossible

Every passkey is unique to one service, generated fresh. There is no equivalent of using the same one twice, so credential stuffing — trying a leaked email and password pair everywhere else — has nothing to work with.

Breaches leak much less

A service that is breached loses its store of public keys. Public keys are designed to be public; on their own they are useless for logging in as you.

Compare that with a password breach, where even hashed passwords can be attacked offline at leisure, and weak ones fall quickly.

The unresolved problem: portability

Passkeys have one genuine open question, and it is not about security.

Where does the private key live, and what happens when that thing is gone?

If your passkeys are held in Apple's keychain, they follow you across Apple devices smoothly and are awkward on a Windows laptop. If they are in Google's, the reverse. Buy a phone from the other ecosystem and you discover your logins are somewhere less convenient than you assumed.

This is why every service currently offering passkeys also keeps a recovery route — usually the password you already had, sometimes backup codes. Which produces the slightly deflating reality of the transition: adding a passkey often does not remove the password behind it. You have added a better front door to a house that still has the old one.

That is not a reason to skip passkeys. The better door is the one you will use daily, and phishing attacks target the door you use. But it does mean the password behind it still needs to be strong and unique, because it remains the fallback an attacker will aim at.

Why a password manager is the sensible place to keep them

The portability problem has a straightforward answer: store passkeys in something that is not tied to one company's hardware.

Password managers now do this. Proton Pass lists passkey support on all devices as part of its free plan, alongside unlimited logins and unlimited devices. Storing passkeys there rather than in an ecosystem means they work on your work laptop, your personal phone and a borrowed computer alike.

There is a pleasing consistency to this. The reason to use a password manager was never really the passwords — it was having one trusted place for the credentials to your life, available everywhere, that you control. Passkeys do not change that argument. They change what is stored in it.

It also means the important question stays the same one: what happens if you lose access to the vault? Zero-knowledge encryption means no vendor can restore it, so emergency access and a written recovery copy matter as much for passkeys as they ever did for passwords — the reasoning is here.

What to actually do

• Accept passkey prompts on important accounts — email, banking, anything holding payment details. These are the accounts phishing targets, and this is the defence that works when you are tired.
• Keep the fallback password strong. It is still there and it is still the way in. Generate a long random one and store it.
• Store passkeys in a password manager, not in one ecosystem, if you use more than one kind of device — or expect to.
• Save the backup codes a service gives you when you enrol, in your vault's secure notes rather than a screenshot.
• Do not wait for the transition to finish. Passwords are not going away soon; the accounts you protect now are protected now.

The honest summary

Passkeys are a real improvement rather than a rebrand. They remove phishing, reuse and breach-leakage in one structural change, which is more than any amount of advice about choosing better passwords has ever achieved.

They also do not replace your password manager — they raise its importance, because a credential that lives on devices needs somewhere portable and recoverable to live. Running both for the next several years is the expected state, not a sign you have set something up wrongly.

If you do not yet have somewhere sensible to keep either, two genuinely free options are compared here, and the wider buying decision is in how to choose a password manager. If your passwords currently live in your browser, that is worth resolving first — honestly assessed here.