Passkeys: what they fix, and what they don’t
Passkeys kill password phishing. They don’t fix account recovery or stolen sessions.
Turn on passkeys. Just don’t think the job is done.
A passkey is tied to the real website. A fake login page gets nothing from your phone, no matter how good it looks. There’s no password to reuse, leak or guess. That alone removes most account takeovers I see.
What it doesn’t fix:
- Recovery. If “lost my passkey” falls back to an SMS code, your account is only as strong as that SMS.
- Stolen sessions. Malware that copies your browser’s session cookie skips the login completely.
- The old password. If the site still accepts it, it can still be phished.
What I do:
- Passkeys first on email, the password manager and cloud accounts. They reset everything else.
- Remove SMS recovery where I can. Recovery codes go somewhere offline.
- Register a second passkey or a hardware key as a backup.
- Admin and finance accounts get hardware keys, not synced passkeys.
After passkeys, the weakest door is usually recovery. Check it.