Setting the next column
CCReference Guide / Strong
Passkeys are phishing-resistant cryptographic credentials. Password managers still hold the majority of logins that have no passkey, plus recovery codes. FIDO's own model includes third-party passkey providers. The 2026 move is not a fork in the road. It is a manager that can store passkeys, used on every site that still wants a password.
The argumentPasskeys, as the FIDO Alliance defines them, replace the typed password with a device-held cryptographic key, unlocked the way you unlock the phone. They are phishing-resistant because the secret never goes to the site and is bound to the real domain. Password managers remain necessary because most services still use passwords, and because NIST's digital-identity FAQ still treats managers as the sane way to generate unique secrets and to paste them. FIDO also defines passkey providers that are not the phone vendor: a manager can store synced passkeys across Windows, Android, and macOS. Device-bound keys on a hardware token are a different, stricter tool. The practical setup is passkeys on every account that offers them, inside a manager or platform that you can recover, and unique passwords everywhere else.
If passkeys are supposed to replace passwords, should I drop my password manager, switch everything to Apple or Google passkeys, or keep both?
Passkeys are better than passwords on sites that support them: no shared secret to phish or stuff. That is FIDO's design, not a brand slogan.
Most of the web still uses passwords. NIST's 800-63 FAQ tells verifiers to allow paste so people can use a manager, and tells users to generate unique passwords and protect the master secret.
A password manager can be a FIDO passkey provider (FIDO names 1Password and Dashlane as examples). That is how you avoid locking every passkey to one phone vendor.
Do not turn off passwords on an account until you have a recovery path you have tested. How to understand passkeys before switching is the recovery-path companion.
The internet loves a versus. Passkeys versus password managers is a bad versus. One is a type of credential. The other is a box you keep credentials in. FIDO's own passkeys page names Google Password Manager and 1Password in the same breath as passkey providers. NIST's identity FAQ still spends a paragraph on how to use a password manager well. The people writing the standards are not asking you to pick a team.
What you should do is turn on passkeys where the site offers them, keep a manager for everything that does not, and decide whether that manager, or Apple, or Google, is the place those passkeys live. Switching phones without a plan is how people lock themselves out of the better credential.
| Job | Passkeys | Password manager |
|---|---|---|
| Sign in without a phishable secret | Yes, on sites that implemented WebAuthn/FIDO | No. It still autofills a secret the site can be tricked into collecting, unless you only use it for passkeys. |
| The other 80 percent of accounts | Cannot help until the site ships passkeys | Unique generated passwords, which is still NIST's practical advice for remaining passwords |
| Recovery codes, API keys, Wi-Fi, notes | Not their job | Yes |
| Moving from iPhone to Windows | Painful if every passkey lives only in iCloud. FIDO: use a cross-platform provider, or re-register. | A cross-platform manager is the portable passkey provider FIDO describes. |
| Highest-assurance, one copy of the key | Device-bound passkey on a FIDO security key | Not a substitute for a hardware-bound key. Can store the backup codes for that key. |
Do you use more than one operating-system family (for example iPhone plus Windows PC)?
Prefer a third-party passkey provider in a password manager you already trust, or Google Password Manager if you live in Chrome on every machine. Apple-only iCloud passkeys will not follow you to a Windows-only work laptop without extra dance steps FIDO documents as cross-device QR/BLE or account recovery.
Platform passkeys are convenient and valid. Still keep a password manager for non-passkey sites. Still write down recovery for the Apple ID or Google account, because that account is now the vault of the vault.
FIDO is explicit that passkeys standing alone are meant to be stronger than password plus SMS or password plus a push prompt, because those second factors are still phishable. That is the argument for turning passkeys on at your email, bank, and Apple or Google account. It is not an argument that the IRS portal, the HOA site, and the old forum have caught up.
NIST's password-manager notes still apply to that remainder: long master passphrase, unique generated passwords, MFA on the vault, and skepticism toward a manager that will email you the master password. Permit paste, which 800-63 already asked sites to do, is how the manager enters a password field without you retyping.
Synced passkeys are a cloud copy of a private key, end-to-end encrypted, according to FIDO. That is a different threat model from a key that never leaves a YubiKey. For a household email account, sync is how you still log in after a cracked screen. For a production cloud root, device-bound is how you sleep. Password managers compared and how to choose a password manager are the product pages. This page is only the division of labor.
Passkeys where offered. Unique passwords in a manager everywhere else.
If you change phone brands, a cross-platform passkey provider is the FIDO-documented path.
Hardware-bound keys for the few accounts that deserve one copy of the secret.
Only after you have signed in with the passkey on a second device and you know the account's recovery path. Some sites still need the password as fallback. How to understand passkeys before switching covers that trap.
No. FIDO: passkey is a common noun for FIDO2 credentials. The difference is the provider that stores and syncs them, not a different kind of math.
On that site, the passkey is the sign-in. You may still keep TOTP in the manager for sites without passkeys. Do not throw away the authenticator app on day one.
Sources and further reading
Passkeys are FIDO credentials: phishing-resistant, no shared secret. Synced versus device-bound. Passkey providers include OS/browser vendors (iCloud Keychain, Google Password Manager) and third parties (1Password, Dashlane). Syncing is end-to-end encrypted. Cross-device sign-in via CTAP hybrid/BLE proximity. Hardware security keys hold device-bound passkeys.
NIST: password managers offer greater security and convenience via unique generated passwords and encrypted vaults. SP 800-63B does not explicitly require managers but recommends verifiers permit paste. Users should choose a long master passphrase, unique passwords, avoid managers that recover the master password, and use MFA on the manager.
NIST supplement treating syncable authenticators (passkeys) as usable at AAL2 with extra requirements. Confirms passkeys as a government-recognized class, not a consumer fad.
Continue reading
Passkeys replace passwords with a cryptographic key pair instead of a shared secret, which closes off the most common phishing trick. The part worth studying before you switch is what happens when you lose a device, because that path runs through account recovery, not through the passkey itself.
Technology / Security / 8 min
READ NEXTAbout the byline
Sources, review method, and commercial relationships appear with each story. Reach the desk at editorial@culturecolumn.com.
