Quick answer: A passkey lets you sign in with a device unlock such as a PIN or biometric check, while a password manager stores and fills credentials for sites that still require passwords. You do not need to abandon the manager when you add passkeys. The safer migration is account by account, with recovery checked before you remove an old sign-in method.
What changes when you use a passkey?
A passkey uses a cryptographic key pair. The service holds a public key; the private key stays with your authenticator or its supported sync provider. The sign-in request is bound to the real website, which helps resist lookalike-site phishing. Your screen lock approves use of the key; the fingerprint or face scan is not sent to each website. FIDO explains the model in its passkey overview.
A password manager still matters. Many accounts have no passkey option, and a manager can generate unique passwords, store recovery codes securely, and in some products store passkeys too. A passkey is an authentication method; a password manager is a tool that may hold several methods. Avoid assuming that adding a passkey automatically disables the old password.
Choose a storage and recovery plan first
| Option | Useful when | Check before relying on it |
|---|---|---|
| Device-bound passkey or security key | You want a separate physical authenticator for a critical account. | Register a spare key or another recovery method; losing the only device may lock you out. |
| Synced passkey | You use several devices in one supported ecosystem. | Understand the sync account’s protection, device enrollment and recovery process. |
| Password manager with passkey support | You already use a cross-platform vault. | Confirm export, device support, vault recovery and how the site identifies saved passkeys. |
NIST’s guidance on syncable authenticators describes the security trade-offs of copying credentials between devices. The best choice depends on your devices and recovery needs; no single storage option is universal.
A reversible migration checklist
- Inventory important accounts. Start with your primary email, password manager, cloud account and banking accounts. For each, note the current sign-in and recovery routes. Do not put actual passwords or recovery codes in the checklist.
- Secure the base. Update devices and your manager, set a strong device lock, and turn on the strongest available multi-factor protection for the account that syncs your passkeys.
- Add one passkey. Open the service’s own security settings by typing its known address or using a trusted bookmark. Name the passkey by device or manager so it is recognizable later.
- Test sign-in. Sign out in a separate browser session, then sign back in. Check that the browser displays the correct site and that the passkey works on the device you expect.
- Test recovery. Follow the service’s documented recovery instructions without deliberately locking yourself out. Confirm that a second device, spare security key or other approved method is available. Store backup codes in a protected place.
- Review old methods. If the site permits password removal, consider it only after the new and backup methods work. If it retains a password, keep it unique in the manager and keep any MFA enabled.
Common failure points
| Situation | Practical response |
|---|---|
| The site offers a passkey but still prompts for a password. | Check which sign-in route you selected and whether the passkey was added to this exact account. Do not type credentials into a link from an unsolicited message. |
| You are changing phone platforms. | Before wiping the old phone, add and test another passkey or recovery route on the destination device. Cross-platform transfer varies by provider. |
| A shared household computer is involved. | Avoid registering a passkey for your personal account in another person’s profile. Use your own device or a dedicated hardware key. |
| A passkey appears in an unexpected place. | Inspect the account’s security settings, revoke unknown authenticators and review recent activity. Change any still-active password from a trusted device. |
What this guide does and does not establish
Passkeys reduce exposure to password reuse and phishing, but account recovery, a compromised device, social engineering and a weak fallback method still matter. This is a planning checklist, not a hands-on test of any vendor’s product. The exact menus and portability depend on the service and authenticator. For the underlying requirements, read NIST SP 800-63B and the FIDO Alliance passkey resources. Review each provider’s current instructions before removing any sign-in option.
