Passkeys Aren't Replacing My Password Manager — Here's the Setup That Actually Works

For about two years I treated passkeys the way I treat most "this changes everything" tech headlines — as something to read about, nod along to, and quietly ignore. My accounts were already sitting behind a password manager and unique generated passwords, so a whole new sign-in system felt like solving a problem I didn't have. Then I actually switched a handful of accounts over, and the thing that changed my mind wasn't security. It was how little I had to think about it afterwards.

The pitch for passkeys is that they kill the password outright: instead of typing a string of characters a phishing page can copy, you approve a sign-in with Face ID, a fingerprint, or your device PIN, and a cryptographic key pair does the rest. No password to leak, reuse or forget. It's a genuinely different mechanism, not just a faster autofill — and that distinction is exactly what I'd been skimming past every time a headline told me passwords were "finally dead."

Why I dismissed it for so long

My reasoning wasn't unreasonable at the time: I already had strong, unique passwords generated and stored for every account, so the marginal security gain from switching felt small next to the hassle of relearning how I log into everything. What I hadn't accounted for was that passkeys aren't really competing with a good password — they're removing the sign-in step almost entirely. Typing nothing beats typing even a manager-filled password, every single time, and I'd never actually felt that difference until I tried it.

What actually changed my mind

It was one ordinary sign-in. I went to log into my Google account on a new laptop, expected the usual password-plus-two-factor dance, and instead got a single Face ID prompt. Done. No typing, no waiting for a text message, no copying a code out of an authenticator app. That one interaction did more to sell me on passkeys than any comparison article had, because it wasn't a feature I had to remember to use — it was just faster than the old way, automatically, every time.

The hybrid setup I actually landed on

I didn't rebuild my entire login system. I turned on passkeys for every account that offers them — Google, Apple, and a handful of others — and left everything else exactly where it already lived, inside the password manager I settled on after actually comparing 1Password and Bitwarden. That turns out to be the setup most security writers land on too once you get past the "passwords are dead" headline: passkeys where a site supports them, a password manager underneath for everything that doesn't, plus the two-factor codes, secure notes and card details a passkey was never designed to hold in the first place.

Modern password managers store passkeys alongside passwords now, which is the detail that made the hybrid setup click for me — I'm not running two separate systems, just one vault that happens to hold two different kinds of credential depending on what the site allows.

"I expected switching to passkeys to feel like a security upgrade. It actually felt like deleting a chore. That's a smaller claim than the headlines make, and it's also the one that's held up on every single login since."

Where passkeys still fall short

Plenty of accounts I use daily — including a few tied directly to running this site — simply don't offer passkeys yet, so a real password is still doing the work there, and will be for a while. Recovery was my other genuine worry going in: if a passkey lives on a device rather than in your head, what happens when that device is gone? In practice they sync through your platform's cloud keychain, so setting up a replacement device and signing back into the same account restores them. I still tested that recovery path deliberately before trusting it, rather than assuming it would just work — the same instinct that made me turn off ChatGPT's memory feature until I understood exactly what it was storing and where.

What I'd actually do this week

Turn on a passkey the next time a major account offers one — Google and Apple both make it a single tap from account settings — and see how it feels on your next few logins before deciding you need a bigger strategy than that. If you're still on reused or weak passwords everywhere else, that's the bigger gap to close first, and it's the exact problem a proper password manager solved for me long before passkeys were part of the picture. The two aren't in competition. I use both, and neither one is going away from my setup any time soon.

Questions people actually ask

Do passkeys replace a password manager?

Not entirely, in my experience. Passkeys are a great replacement for a password on the sites that support them, but a password manager still does work passkeys don't touch: storing actual passwords for the sites that haven't added passkey support, holding two-factor codes, secure notes and card details, and letting me share a login with someone else. I use both, not one instead of the other.

Are passkeys actually more secure than a strong password?

Yes, and it's the one claim in the passkey pitch I haven't found a reason to doubt. A passkey is a cryptographic key pair rather than a string of characters, so there's nothing to type, nothing to guess, and nothing a phishing page can trick you into handing over — the private half never leaves your device. A strong, unique, manager-generated password is very good. A passkey removes the category of attack entirely.

What happens if I lose the phone my passkeys are stored on?

This was my biggest hesitation before I actually tested it. Passkeys sync through your platform's cloud keychain (iCloud Keychain, Google Password Manager, or your password manager's own sync), so setting up a new device and signing back into that same account restores them — it isn't a single point of failure the way losing a hardware key can be. I'd still keep a password manager as a fallback until you've genuinely confirmed that recovery works for your own accounts.

Should I switch to passkeys in 2026?

Use a passkey wherever a site offers one — it's faster and safer with no real downside. I wouldn't go looking for a way to force every account onto passkeys this year, though, because plenty of the services I use daily still don't support them, and a password manager is still doing the majority of the actual work in my setup.