Passkeys change login, not every risk

A passkey uses public-key cryptography. The service keeps a public key, while an authenticator uses the private key to answer a challenge. The fingerprint, face check or PIN that unlocks the device is not a password sent to the website.

FIDO distinguishes synced passkeys from device-bound ones. That distinction affects everyday convenience and what happens when a device is lost.

Authentication is bound to the intended service. A lookalike domain cannot simply collect and replay the passkey as it could a typed password. This matters more than removing a typing step.

NIST sets different requirements for different assurance levels. Supporting passkeys does not automatically mean a service or device meets the highest level.

What happens when your phone or sync account becomes unavailable? The answer depends on the provider, registered devices and recovery methods. A weak recovery route can undermine a strong login.

Check the process the service actually offers rather than relying on a feature announcement. Understand where synced credentials are managed and how an unwanted device can be removed.

A stronger login does not replace operating-system updates, device protection or session management. Someone controlling an unlocked device or an active session may not need to authenticate again.

Organisations must consider lost devices, departing employees and access revocation. Individuals also benefit from knowing how to review and close existing sessions.

Start with a service whose recovery process you understand. Add a protected backup method where supported, and check the process across the devices you use.

Keeping a weak password indefinitely is not the only way to feel safe. The goal is a recovery method that is usable, well protected and documented.