Dollars & Sense: Passkeys vs. passwords – Is it time to make the switch?

 

What to Know:

• Passkeys offer a safer alternative to passwords, allowing you to sign in using your fingerprint, facial recognition, or device PIN.
• Passkeys are designed to protect against phishing and stolen passwords, making it much harder for criminals to access your accounts.

• But before making the switch, understand how passkeys work across multiple devices and what happens if your phone is lost, stolen, or replaced.

ORLANDO, Fla. – For decades, we’ve been told to create strong passwords for our digital lives.

Avoid using the same one for multiple accounts. Change them if they’re compromised. Don’t use your dog’s name. And for goodness sake, please stop using 12345678 or “password” for your… password.

But remembering dozens of complicated passwords can be frustrating, and even the strongest passwords aren’t foolproof. Then there are all those requirements: an uppercase letter, a number, a special symbol, and at least eight or even up to 15 characters (I have one that’s 22!).

Oh, and change it every 90 days. Unless there’s a data breach, and in that case CHANGE IT RIGHT NOW!!!

Seriously, think about how much of our daily lives now takes place online. Banking, shopping, paying bills, managing healthcare, and, of course, social media. What started out as a handful of passwords has become a seemingly endless collection of credentials we need just to get through the day.

Now, there’s an alternative that promises to make accessing your online accounts both easier and more secure.

They’re called passkeys, and instead of remembering a password, you can use your fingerprint, facial recognition, or the PIN you already use to unlock your phone, tablet, or computer. But are they really safer? How do they work when you use multiple devices? And what happens if you lose or sell one of those devices?

You Have Questions, We Have Answers

Usually, Dollars & Sense takes a complicated consumer issue and breaks it down into something easier to understand. But this time out, we’re doing things a little differently. Because passkeys are still unfamiliar to many consumers, let’s go back to the basics and approach the topic old school: with a question-and-answer format.

So, let’s start with the obvious.

Q: What exactly is a passkey?

Think of a passkey as a digital key that replaces the password you would normally type to access an online account. Instead of remembering a complicated combination of letters, numbers, and symbols, you sign in using the same method you use to unlock your phone or computer, whether it’s using your fingerprint, facial recognition, or a PIN.

But unlike a traditional password, a passkey isn’t a secret word or phrase you type into a website. It’s a unique digital credential that allows your device to prove you’re authorized to access your account without revealing the credential itself.

Q: So then how is a passkey different from a password?

The biggest difference is how they verify your identity.

With a traditional password, you type a combination of letters, numbers, or symbols into a website, which checks whether it matches the credentials associated with your account.

With a passkey, there’s no password to type or remember. Instead, your device verifies you’re authorized to access the account. And here’s an important distinction: your fingerprint, facial recognition, or PIN isn’t the passkey – it’s simply how you unlock the digital credential in your device that does the work behind the scenes.

Q: But can’t hackers steal your passkey, too?

It’s much harder than stealing a password, but passkeys aren’t completely foolproof.

Here’s why: when you create a passkey, two mathematically connected digital keys are generated. One is a public key, which is shared with the website. The other is a private key, which is securely stored on your device or protected by your passkey provider. When you sign in, the website uses the public key to verify proof generated using your private key; the private key is never sent to the website. So, even if hackers breach the website and steal its account database, they won’t find your private key there.

On many devices, that private key is protected by specialized security hardware, making it much harder for hackers or malicious software to access. Passkeys also protect against phishing because they’re tied to the legitimate website. A fake website can’t simply trick you into entering your passkey the way it might trick you into revealing a password.

There is, however, still a risk.

If someone gains access to your unlocked device or takes over your passkey provider account – an Apple, Google, or password manager account – your accounts could be vulnerable. With that said, while passkeys eliminate some of the biggest security risks associated with passwords, they don’t eliminate every risk.

Q: Do I need a separate passkey for every device I use?

Not necessarily. And this is where things can get a little confusing. There are two main types of passkeys: synced passkeys and device-bound passkeys.

Synced passkeys can be securely stored and shared across devices using services such as Google Password Manager, Apple’s Passwords app, or a compatible password manager. That means you may be able to use the same passkey on your phone, tablet, and computer without creating a separate one for each.

Device-bound passkeys, on the other hand, remain tied to a particular device and aren’t automatically shared with others. A physical security key, such as a YubiKey, is one example.

But here’s something you might not realize: even if your passkey is stored only on your phone, you can often use it to sign in on another computer by scanning a QR code and approving the login on your phone. In that case, the passkey stays on your phone – it doesn’t have to be copied onto the computer you’re using. Your phone, however, does need to be physically near the computer because it uses Bluetooth to confirm you’re there (another layer of protection against remote attackers).

There’s also one big catch to consider: just because a passkey can be synchronized doesn’t mean it will automatically work across every device you own.

Different operating systems and passkey providers don’t always share credentials seamlessly. And if you create separate passkeys for the same account on different devices, you could end up managing several digital keys instead of just one password. The good news: that QR-code sign-in generally works between any combination of Windows, Mac, iPhone, and Android.

Syncing is where it gets spotty.

Q: Where are my passkeys stored, and how can I find them?

On Apple devices, passkeys are typically managed through the Passwords app and synchronized using iCloud Keychain. Android users may find theirs in Google Password Manager.

On Windows 11, you can manage passkeys through Windows Settings. And since late 2025, Windows also lets you save passkeys to Microsoft Password Manager – which syncs through your Microsoft account – or to a third-party manager such as 1Password or Bitwarden. Those third-party password managers can also store and synchronize passkeys across different operating systems.

Here’s where things can get confusing. You might have some passkeys stored in Google Password Manager, others saved directly on your Windows computer, and still others managed by a separate password manager. The good news is you can generally review and delete passkeys through the service or device where they’re stored.

One caution: if a passkey is synced, deleting it on one device typically deletes it on all of them. Many websites also let you see which passkeys are registered to your account and revoke ones you no longer use.

And that’s worth checking periodically, especially if you’ve replaced, sold, or stopped using a device.

Q: What happens if I switch from an Android phone to an iPhone, or vice versa?

I have to admit, initially, I didn’t even think of this one.

Your passkeys won’t necessarily follow you automatically, and that’s something worth checking before switching phones. Passkeys saved to Apple’s Passwords app sync across Apple devices – and to Windows PCs through the iCloud for Windows app – but not to Android.

Google has closed part of that gap.

Since early 2025, iPhone users running iOS 17 or later can save and use Google Password Manager passkeys through Chrome. If your passkeys live in Google Password Manager, moving from Android to iPhone is a lot easier than moving from iPhone to Android with passkeys stored in Apple’s app.

Third-party password managers, including 1Password and Bitwarden, are a different story – they support passkeys across multiple operating systems, making it easier to move between devices.

There’s also a newer industry standard, called the Credential Exchange Protocol, that lets you securely transfer passkeys from one password manager to another. Apple added it in iOS 26, and Android supports it through a Google Play Services update. The catch: both the app you’re moving from and the app you’re moving to have to support it.

If you’re planning to switch phones, check where your passkeys are stored before getting rid of your old device. Make sure you have another way to access your important accounts, whether that’s another registered passkey, a supported transfer method, or an account recovery option.

And don’t erase your old phone until you’ve confirmed you can sign in to your most important accounts on the new one.

Q: What happens if I lose, replace, or sell my phone?

Losing your phone doesn’t necessarily mean losing access to your passkeys or the accounts they protect. If your passkeys are synchronized through a service such as Google Password Manager, Apple’s Passwords app, or a compatible third-party password manager, you can generally recover them on another device after verifying your identity and meeting the provider’s recovery requirements.

But if your passkeys are stored only on the missing device, things can get more complicated. You may need to use another registered passkey, an alternative sign-in method, or the website’s account recovery process to regain access.

And what if someone steals your smartphone?

The good news is that having your phone doesn’t automatically give a thief access to your passkeys because they generally need to unlock the device first.

And if they do know your PIN or you didn’t lock your phone?

Well, that’s like handing someone the keys to your car. Having the keys doesn’t guarantee they’ll steal it, but you’ve certainly made their job a lot easier.

Ba-bye.

Luckily for you, Apple and Google have both added features aimed at exactly this scenario.

Apple’s Stolen Device Protection and Android’s theft protection settings can require your face or fingerprint – not just your PIN – before someone can get at saved passwords or change key security settings when your phone is away from familiar locations. Turn them on.

Back to the stolen car scenario: they may have the keys and be driving it around, but with these settings turned on, getting into the glovebox – where your sensitive info is stored – gets a lot harder.

If your phone is lost or stolen, use the manufacturer’s remote-lock or device-location tool. Then secure your associated accounts and review your registered passkeys. You can also revoke passkeys associated with the missing device through websites that offer that option.

And if you’re selling, trading in, or giving away a device, make sure you’ve securely erased it using the manufacturer’s factory-reset procedure. Before doing so, confirm your passkeys are available on another device or that you have another way to access your accounts. Remember, erasing a passkey from your device doesn’t necessarily revoke it from the website where it’s registered.

Is it time to make the switch?

The bottom line: passkeys can be more secure than passwords, but they’re not a substitute for protecting your devices and having a reliable way to recover your accounts.

To answer the question: for most consumers, yes, it’s time to make the switch. But there’s no need to abandon all your passwords overnight. Start with one or two important accounts that support passkeys and make sure you understand where those credentials are stored. And before switching, check your account recovery options and confirm you can still sign in if your primary device is lost, stolen, or replaced.

Finally, remember that creating a passkey usually doesn’t eliminate your old password. Most websites keep it as a backup way to sign in – which means it can still be stolen or phished.

So, even with a passkey, keep that password strong and unique.