Passwords fail for a simple reason: the same secret is stored in two places, and one of them is a server you do not control. When that server leaks, the secret is gone. When a convincing fake site asks for it, people type it in. No amount of complexity rules fixes a design in which the secret has to be sent to be checked.
Passkeys change the design rather than the rules.
How they work, briefly
When you register a passkey with a site, your device creates a pair of mathematically linked keys. One half, the public key, is sent to the site and stored. The other half, the private key, never leaves your device. It sits in a secure area of the hardware and is unlocked by whatever you already use to unlock the device: a fingerprint, a face, a PIN.
When you sign in, the site sends a random challenge. Your device signs it with the private key. The site checks the signature with the public key it stored. Nothing secret crosses the network, so nothing secret can be intercepted, and a database breach yields a pile of public keys that are useless without their private halves.
The passkey is also bound to the site’s real address. A fake site with a similar name cannot ask your device for a signature that belongs to the real one. That single property removes the most common form of phishing.
Where the trust goes
Every security design moves trust somewhere. Passkeys move it from the website’s password database to three places.
Your device. If someone can unlock it, they can use your passkeys. Device security becomes account security in a much more direct way than before.
Your platform account. For passkeys to survive a lost phone, they have to be backed up and synchronised. That means the ecosystem you use, whether it is a phone maker, a browser vendor or a password manager, holds an encrypted copy. The encryption is strong, but the recovery process for that account is now the weakest link for everything protected by it.
Recovery processes. When a device is lost and the sync account is unavailable, what happens? Sites still need a recovery path, and recovery paths are where attackers go when the front door is locked. A site with excellent passkey support and a weak “forgot my device” flow has not improved much.
The practical questions
Can you move passkeys between ecosystems? Increasingly yes, but it is still less smooth than exporting a password list, and it depends on which vendors you use.
Should you keep a password as well? Many sites keep it as a fallback, which means the old weakness remains. The strongest position is passkeys plus a recovery method you actually understand, with the password removed once you trust the setup.
What about shared accounts? Passkeys are personal by design. Shared logins need a different answer, usually delegated access rather than shared secrets.
The honest verdict
Passkeys are the biggest practical improvement in everyday authentication in decades, and the criticisms of them are mostly about the surrounding systems rather than the cryptography. They remove the two failure modes that cause the most harm: reuse and phishing. What they add is a dependence on device and platform security that is worth understanding before you rely on it.
Use them. Understand your recovery path. Do not assume the marketing covers the second part.
