Passkeys and Passwords: Where a Password Manager Sits
Passkeys are usually presented as the replacement for passwords, and the framing is not quite right in either direction. They are not a replacement so much as a second mechanism that handles some cases better, works differently in a way that matters, and leaves others untouched. Understanding what a password manager does with passkeys — which is more interesting than the general passkey story — matters because it determines whether your existing setup needs to change.
Table of contents
- What a passkey is, precisely
- The property that matters: the origin is checked
- What a password manager actually does
- Sync, backup and the recovery problem
- Using both, and what to keep where
- FAQ
- Bottom line
What a passkey is, precisely
A passkey is a cryptographic key pair, where the private key stays on your device and the public key is registered with the service. When you sign in, the service sends a challenge, your device signs it with the private key, and the service verifies the signature against the public key it holds.
The important part is what never happens: no secret is shared with the service. In a password login, the server receives something it can store, compare and, if compelled, hand over. In a passkey login, the server holds a public key that cannot be used to impersonate you, and the private key never leaves your device.
The property that matters: the origin is checked
The reason passkeys resist phishing is worth stating carefully, because it is not that they are unguessable.
When you sign in with a passkey, the credential is cryptographically bound to the site's origin. The browser will only offer the passkey for the domain it was created for, and the service will only accept a response signed by the key registered for that domain. A convincing fake login page is therefore not enough: the credential simply will not work, because the key belongs to a different origin. A lookalike domain cannot present it, and a browser cannot be tricked into offering it, because the browser checks the origin before it prompts you.
This is a structural property rather than a probabilistic one. It is not that a fake page is less likely to be detected; it is that a fake page cannot receive a valid response. That is why passkeys resist phishing better than any password policy, including long generated passwords, which can be phished perfectly well if you type them into a convincing form.
What a password manager actually does
There is a widespread belief that passkeys make password managers obsolete. They do not, and the reason is worth knowing precisely.
- Passkeys are device-bound by default. A passkey created on a laptop lives on that laptop. To use it elsewhere, you either sync it through the platform or move it through a manager.
- Password managers can store and sync passkeys. Most now can create, store, and sync passkeys across devices, which means the portability problem that limits raw platform passkeys is solved by the manager. This is becoming the main reason to keep one.
- Passkeys do not cover everything. Any service that has not implemented passkeys still needs a password. And some situations have no passkey option at all.
- Passwords remain necessary as the recovery path. A passkey can fail: a lost device, a reset, a platform account issue, a service that removes the credential. The password is what gets you back in, and it is still stored in the manager.
- The manager remains the index. Which service, which account, which username, which email it was registered with. That metadata is the manager's real function, and passkeys do not replace it.
The practical picture: passkeys remove the phishable secret for the services that support them. The manager remains what makes them usable across your devices, and remains necessary for everything else.
Sync, backup and the recovery problem
There is a property of passkeys that is easy to miss and that changes the risk calculation: a passkey cannot be phished, but it can be deleted.
Passwords have a recovery path that everyone understands. Forget the password, reset it with an email code, get back in. A passkey has no equivalent in the general case, because the private key exists on your device and in whatever backup you chose. Lose every copy and the credential is gone. The account may still be recoverable through other registered methods, and most services do keep a password fallback, but that is a service-side policy rather than a guarantee.
This makes two things worth checking, and they are the practical content of this guide.
- How many passkeys are registered for an important account, and which devices hold them. If an account has one passkey on one device, that is a single point of failure.
- Whether the account still has a working password in your manager. Keep it. It is the recovery path for the passkey.
Also worth knowing: a service that offers passkeys usually keeps them recoverable through the account's other methods, but the ways to recover a passkey are not always surfaced clearly in the interface. Before relying on a passkey for an account you care about, find out how you would get back in if the device were lost. [VERIFY the recovery options any service you use offers, since they change.]
Using both, and what to keep where
The setup that works is unglamorous: keep everything in the manager, and let the manager decide what happens on each site.
- Let the manager create the passkey where the site supports one and the manager supports the flow. That way the credential is stored and synced with everything else, rather than living on one device.
- Keep the password in the manager as well. Not because you will type it, but because it is the recovery path, and because the site may not support passkeys on every entry point.
- Do not keep a passkey on a device you might lose unless it is synced or backed up, and do not keep the only copy of a credential on a shared machine.
- For accounts with no passkey support, use a generated unique password and let the manager handle it. That is still the correct answer, and for many services it remains the only answer.
- Do not enable every available passkey at once. Some services implement multi-device passkeys differently, and the recovery story is not always as good as the sign-in experience. Start with the accounts where the risk is highest, and check recovery before you rely on it.
- Know which of your accounts still depend on a password alone. That list is where the remaining risk is concentrated, and it is usually shorter than people expect.
One practical point about switching an existing account to a passkey: check whether the service keeps the old password as a fallback or replaces it. Most keep it, and some let you remove it. Removing it is the right call once the passkey is working across your devices, and it is the point at which the account stops being reachable by a phishable secret.
FAQ
Should I remove my passwords once I have passkeys?
Keep the password in the manager as the recovery path. The security benefit of a passkey is that it cannot be phished; the benefit of removing the password is that there is no phishable secret at all. The first is worth having immediately, and the second is worth doing once the passkey works reliably on every device you use and you have confirmed how to recover it.
Can a passkey be stolen?
Phishing does not work against it, because of the origin binding. Physical theft of an unlocked device can allow use of a passkey on it, which is why device lock, screen lock and biometric protection matter. And a passkey stored in a compromised account — a platform account or a manager account — can be abused, so the security of those accounts becomes part of your security. There is also the case of a malicious or compromised application on the device, which is a general mobile risk rather than a passkey-specific one.
Does a password manager slow down passkey sign-in?
It depends on the flow. Passkeys are usually fast, and a manager that handles them well is not slower than the platform’s own prompt. Where a manager adds friction — an extra unlock, a slow extension load — it is worth fixing rather than working around, because a friction point is where people fall back to typing passwords.
What about accounts that do not support passkeys?
They still need passwords, and for those a generated unique password in the manager remains the correct answer. There is no alternative mechanism available for them, which is worth remembering before assuming a passkey strategy removes the need for a password manager at all.
Can I use a hardware security key instead?
Yes, and for high-value accounts it is the strongest option available, because the key has to be physically present. The trade-offs are that it is one more device to carry, it cannot be backed up the way a synced passkey can, and it needs to be registered in advance for each service. A common practical approach is a hardware key for the accounts that matter most and synced passkeys for everything else.
What happens if I lose my phone and my laptop?
For synced passkeys stored in a manager, you sign in on a new device and they come with you. For platform-held passkeys, you generally need another device from the same platform account, which is where registering a passkey on more than one device matters. For a hardware key, you need a backup key or a second registered device. The general rule: register important credentials on at least two paths, and know which two.
Bottom line
Passkeys are a genuine improvement for the services that support them, and the reason is structural rather than incremental: the credential is bound to the origin, so a convincing fake page cannot receive a valid response. They are not a replacement for a password manager, because the manager is what makes them portable across devices and remains necessary for the accounts that have no passkey option and for the recovery path when one fails. The setup that works is straightforward: create passkeys through the manager so they sync, keep the password alongside as the recovery route, register important credentials on more than one device, and keep an eye on which accounts still depend on a password alone. Do that and the phishable part of your credential set shrinks substantially without anything breaking.
If you want to see current password manager pricing, the link below goes to our own page for the category.