The failure mode with passkeys is not phishing. It is a person who creates one passkey on one phone, deletes the password because a blog told them passwords are obsolete, and then loses the phone on a Friday night. What follows is how to get the convenience without betting the account on a single piece of hardware.
What a passkey replaces, and what it leaves alone
A passkey is a key pair. The private half stays inside the device’s secure hardware — the Secure Enclave on an iPhone, the Titan chip or Knox Vault on an Android handset, the TPM on a Windows PC — and the public half sits with the website. Nothing reusable crosses the network, which is why a passkey cannot be typed into a fake login page: the browser only offers it to the exact domain that registered it.
That solves phishing and credential stuffing in one move. It does not solve account recovery, shared logins, or the second-hand laptop running a browser from 2019. Those are still your problem, and they are where setups break.
Create the first one on an account you can afford to lose
Start somewhere low-stakes — a forum, a shopping account, a spare Google profile — so a mistake teaches you something instead of locking you out of email. The Google flow is representative: sign in, open myaccount.google.com, Security, How you sign in to Google, Passkeys, then Create a passkey. Confirm with Face ID, a fingerprint, or your Windows Hello PIN.
Watch where the passkey lands. On an iPhone it goes into iCloud Keychain; on Android into Google Password Manager; on Windows into Windows Hello, which by default is bound to that one machine. The first two sync across devices signed into the same account. The third usually does not, and that difference decides whether you can still log in from a hotel business centre.
Prove the fallback works before deleting the password
Resist the tidy-up instinct. Before you remove the password from any account, do all four of these:
- Sign in with the passkey from a second device, or from a browser profile that has never seen the account.
- Confirm the password still works in a private window, so you know it has not been silently retired.
- Generate and store the backup codes as a file, not as a screenshot in the photo library that syncs to the same account you are protecting.
- Check the account’s recovery email and phone number are current, since recovery is the path you will need if the passkey device dies.
Then, and only then, remove the password. Google, Microsoft and Apple all let a password and a passkey coexist indefinitely, and coexistence is the safer default for the first month.
The cross-device traps worth knowing about
Three scenarios cause most of the support tickets. The first is a desktop passkey created with Windows Hello: it works on that PC and nowhere else, so a replacement laptop means re-registering. The second is signing in on someone else’s computer, where the browser shows a QR code and uses Bluetooth to confirm the phone is physically nearby — that only works if both devices have Bluetooth on and the phone is unlocked. The third is an old Android phone without Google Play Services updates, which may simply never offer the passkey option, leaving the password as the only route.
There is also the shared-account problem. A streaming subscription or a family email inbox has no single human owner, and a passkey belongs to a person, not a household. Keep shared credentials in a password manager with a shared vault and reserve passkeys for accounts with exactly one owner.
When the phone is gone
Sign in from any device that still holds a synced passkey, open the account’s security settings, and remove the passkey tied to the lost hardware. Then register a new one on the replacement. With iCloud Keychain or Google Password Manager this is routine, because the passkey exists on more than one device.
Without a second device it becomes an account recovery case, measured in days rather than minutes, and the outcome depends on whether your recovery email is still reachable. That is the whole argument for two passkeys on two platforms: one in the phone’s keychain, one on a hardware key in a drawer or on a tablet that stays home. A £25 USB security key is cheaper than a week without email.
If you want the shorter version of this argument, it is that passkeys remove the weakest link — the typed secret — while leaving every recovery path exactly as fragile as you built it. Fix the recovery path first, and the passkey becomes the easy part. The phone-side version of the setup is covered in passkeys on your phone, and a password checkup is a sensible first job before you migrate anything. Google’s own walkthrough is at Sign in with a passkey instead of a password.