What a passkey actually is
A passkey is a cryptographic key pair. The private half stays on your device, protected by your fingerprint, face or device PIN. The public half sits with the website. When you sign in, your device proves it holds the private key without ever sending it.
That mechanism removes three attacks at once. There is no shared secret to steal in a breach, because the site only stores a public key. There is nothing to phish, because the key is bound to the real domain and simply will not fire on a lookalike. And there is nothing to reuse across sites, because each passkey is unique by construction.
This is a genuine improvement, not marketing. The catch is coverage.
Why you still have passwords
Passkey support arrived first at the large platforms and has spread unevenly since. Your bank may support them; your utility provider, your kid's school portal, the forum you joined in 2014 and half of your work tools almost certainly do not.
Count the accounts in your own vault. For most people the passkey-capable share is a minority, and the rest still need long, unique, random passwords, which is exactly what a password manager exists to generate and remember.
Legacy accounts are also where the damage happens. Attackers do not target the account with the passkey; they target the forgotten one with the password you reused in 2018.
The recovery problem nobody mentions
A passkey lives on a device. Lose every device that holds it and you fall back to whatever recovery method the site offers, which is frequently an emailed link, which is protected by a password. The chain is only as strong as its weakest fallback.
Platform sync helps: Apple, Google and Microsoft all sync passkeys across their own ecosystems. It also creates lock-in, because a passkey synced through one vendor is awkward to move to another.
This is the strongest argument for storing passkeys in an independent password manager instead. 1Password (9.7/10) and Bitwarden (9.4/10) both store passkeys alongside passwords and sync them across platforms, which keeps recovery in one place and keeps you portable.
What a manager still does that passkeys don't
It holds everything that is not a login: recovery codes, software licences, wifi credentials, passport numbers, the answers to security questions you invented.
It audits. A good manager tells you which passwords are reused, which are weak, and which appeared in a known breach. Passkeys have no equivalent because there is nothing to audit.
It shares safely. Getting a credential to a family member or a colleague without sending it over chat is a routine need, and vault sharing is the only clean answer.
It fills forms and it works on the awkward long tail: the router admin page, the old device, the site whose login flow predates modern standards.
The setup worth adopting
Use a password manager as the system of record for everything. Turn on passkeys wherever a site offers them, and store those passkeys in the manager rather than in a single platform's keychain, so losing a phone is an inconvenience rather than an emergency.
Keep two-factor authentication on for accounts that still use passwords, and prefer an authenticator app or a hardware key over SMS.
Protect the vault itself properly: a long unique master password you have never used anywhere else, plus a second factor on the vault account, plus the printed recovery kit stored somewhere physical. See our password manager rankings for how the main options compare on exactly these features.
If cost is the deciding factor, Bitwarden's free tier covers unlimited passwords across unlimited devices, which is more than most people need.
When passkeys will actually replace passwords
Not soon, and not evenly. Adoption is driven by each site rebuilding its own authentication, and the sites least likely to do that are the small ones holding data you have forgotten about.
The realistic outcome for the next several years is a mixed vault: passkeys for the big accounts, strong generated passwords for the rest, one tool holding both.
Anyone telling you to cancel your password manager because passkeys have arrived has not counted their own accounts.