Passkeys in Password Managers, Explained: What Changes When There Is No Password Left to Steal

A passkey replaces the shared secret you type with a key pair your password manager holds — the private half stays in your vault and the site keeps only the public half — so a fake login page gets nothing to relay and a breached server has nothing that can sign in as you.

When a site offers you a passkey, the change is fundamental: there is no longer a password for that account — nothing you know, type, reuse, or hand over by mistake. In its place, your password manager creates a pair of cryptographic keys, keeps the private half inside your vault, and registers the public half with the site. Signing in becomes approving a request with your face, fingerprint, or device PIN. The secret that used to travel across the internet on every login never leaves your manager.

What a passkey actually is

According to the FIDO Alliance, a passkey is a FIDO authentication credential based on the FIDO2 standards (WebAuthn and CTAP). When you create one, your device or password manager generates a unique key pair for that one account on that one site. The public key goes to the site, which stores it. The private key stays with you, inside your manager, and is never sent to the site — not at setup, not at sign-in, not ever.

At sign-in, the site sends a one-time challenge. Your manager, once you approve it locally, signs that challenge with the private key, and the site checks the signature against the public key it holds. A correct signature proves you hold the private key, without revealing it. Each account gets its own key pair, so a passkey for your bank has no relationship to one for your email.

This is also why the unlock feels so simple. The fingerprint or face scan does not travel anywhere. As the FIDO Alliance explains, biometric processing stays on the device and is never sent to a remote server; the server only receives assurance that the local check succeeded. Your PIN works the same way — it unlocks the credential locally.

Why a fake login page gets nothing

Most account theft starts with a secret changing hands: a password typed into a convincing copy of a real site, or a password database stolen from a server and cracked later. Passkeys remove both routes, structurally rather than by asking you to be more careful.

First, the credential is bound to the real site's origin. Your manager will only offer a passkey to the domain it was created for, so a look-alike domain — however perfect its copied page looks at 11 p.m. when you are tired — cannot call up the credential at all. Second, there is nothing to type, so there is nothing to trick out of you. Third, a site stores only a public key; if that database leaks, the keys in it cannot sign in as anyone, because the private halves were never there.

CISA makes the same point in its phishing-resistant MFA guidance, naming FIDO authentication the gold-standard approach because it prevents credentials from being presented to an attacker-controlled site at all — unlike passwords with texted codes, which a fake page can relay in real time. Our password managers ranking reflects how complete the shift has become: all ten ranked managers can now store passkeys, so the question for shoppers is no longer whether a manager supports them, but how well it handles the rest of the vault.

Synced passkeys in a manager, and device-bound passkeys

Passkeys come in two forms, and the difference decides what happens in real life. A synced passkey is copied, in encrypted form, across your devices through your password manager or platform account: create one on your phone and it is waiting on your laptop. A device-bound passkey never leaves the device or hardware key that created it — tightest control, at the cost of convenience.

NIST has weighed in on this trade-off. Its Digital Identity Guidelines (SP 800-63B, including the supplement on syncable authenticators) recognize a properly configured synced passkey as meeting Authentication Assurance Level 2 (AAL2) and as phishing-resistant, while device-bound passkeys can meet the higher AAL3. In plain terms, the synced kind you will actually use every day is strong enough for high-confidence sign-in; the stricter tier is for situations demanding hardware that cannot be copied at all.

For most households, synced is the right default. The realistic risks are a lost phone and a forgotten password, not a targeted attack on one person's vault — and synced passkeys are built for the first two. Device-bound keys make sense as an extra layer for an especially sensitive account, or where an employer requires one.

When the phone is lost, replaced, or shared

This is where passkeys stored in a manager earn their keep. Lose a phone holding only device-bound credentials and you face a recovery process for every account on it. Lose a phone whose passkeys sync through your manager, and the routine is familiar: sign in to the manager on the new phone, unlock the vault, and your passkeys are there. Apple's documentation makes the same point for its synced keychain, noting that passkeys are recoverable even if a user loses all of their devices, through protected account recovery.

Sharing works differently than it did with passwords, and mostly better. Instead of reading a password aloud or texting it — where it lingers in message history — many managers let you share an item directly with a family member's own vault, so it moves without ever being displayed as copyable text. Each person still approves sign-ins with their own face or fingerprint, on their own device.

One caution matters: a synced passkey is only as protected as the account and master password guarding the vault it syncs through. Syncing does not weaken the cryptography, but it does concentrate it — which leads directly to what does not change.

What does not change: passwords, fallbacks, and the master password

Passkeys do not make passwords disappear, at least not this year. Many sites still offer a password alongside a passkey, some have not added passkeys at all, and account recovery almost everywhere still falls back to older methods. That fallback is the honest weak point: an account whose recovery flow is a texted code is, at the moment of recovery, only as strong as that code. Set recovery options deliberately, and treat your recovery email account as one worth a passkey of its own.

Your manager's master password remains exactly as important as it was. It is the key to a vault that now holds passkeys as well as passwords, so it should be long and unique, paired with the strongest sign-in protection the manager offers for the vault itself. Passkeys raise the value of the vault; the vault's own lock should rise with it.

A passkey also does only one job — proving you to a site. It does not hide your traffic or filter malicious downloads; those are separate questions, covered in our VPN ranking. How we weigh claims like these is set out in our methodology.

The sensible way to start is small: turn on a passkey for your email account first, since email resets everything else, then for banking and shopping accounts as they offer it, keeping your passwords in the manager alongside. Within a few weeks, the accounts you use most will be the ones with nothing left to steal.

Sources

• FIDO Alliance — Passkeys: https://fidoalliance.org/passkeys-2/
• FIDO Alliance — Passkey Index 2026: https://fidoalliance.org/passkey-index-2026/
• NIST — Incorporating Syncable Authenticators Into NIST SP 800-63B (SP 800-63Bsup1, superseded by SP 800-63B-4): https://www.nist.gov/publications/incorporating-syncable-authenticators-nist-sp-800-63b
• CISA — Implementing Phishing-Resistant MFA: https://www.cisa.gov/news-events/alerts/2022/10/31/cisa-releases-guidance-phishing-resistant-and-numbers-matching-multifactor-authentication
• Google — Manage passkeys in Chrome: https://support.google.com/chrome/answer/13168025?hl=en&co=GENIE.Platform%3DDesktop
• Apple — Use passkeys to sign in to websites and apps on iPhone: https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-websites-and-apps-iphf538ea8d0/ios