Passkeys are becoming a practical alternative to passwords for many online accounts. They can reduce exposure to phishing, remove the need to memorise reusable secrets and let people sign in by unlocking a phone, computer or security key. But replacing the password field is only part of the change. The harder question is what happens when a device is lost, replaced, damaged or inaccessible.

Account recovery may determine whether passwordless login improves security in practice. A service can protect everyday sign-ins with a passkey, but attackers may still target weaker routes back into an account, such as poorly secured email recovery, SMS messages or customer-support processes. The security of an account depends on its recovery options as well as its primary sign-in method.

Passkey support is expanding across major operating systems, browsers, password managers and online services. Passwords will remain necessary for many accounts during a long transition. Still, passkeys change the basic login model: instead of typing a secret that can be copied, a user proves control of a credential protected by a device or passkey manager.

Why passwords remain a security problem

Passwords require people to create a unique secret for every account, remember it or store it safely, and avoid entering it into fraudulent websites. That is difficult at internet scale. People often reuse passwords, make predictable variations or use weak credentials. A breach at one service can then put accounts elsewhere at risk.

Password managers reduce this burden by generating and storing unique passwords. They remain useful, especially for services that do not yet support passkeys. But passwords have a structural limitation: they are reusable secrets. A fake sign-in page can request a password, and someone who obtains it may be able to try it from another device.

Multi-factor authentication adds another check, such as an authenticator-app code, SMS code or hardware security key. This is generally better than a password alone, but protection varies. SMS can be widely accessible, yet phone numbers may be vulnerable to takeover attempts and codes can be collected through real-time phishing scams. Authentication apps avoid some SMS-specific risks, but users can still be tricked into entering a code on a fraudulent site.

How passkeys work

Passkeys use public-key cryptography, a technology also used in other parts of modern internet security. When someone creates a passkey for a website or app, their device creates two linked digital keys.

• The private key remains protected by the user’s device or passkey manager.
• The public key is registered with the website or app.

When the user signs in, the service sends a challenge. The device uses the private key to create a response, which the service verifies using the public key. The private key is not sent to the service.

For most users, the process is simpler than the technical explanation. A phone or computer may ask for a fingerprint, face unlock or device PIN. These checks unlock the credential locally. The website generally receives neither the user’s biometric data nor the device PIN.

Passkeys are commonly implemented through standards associated with the FIDO Alliance. WebAuthn, or Web Authentication, is a web standard that allows browsers and sites to use public-key credentials. FIDO2 is often used to describe the broader standards framework that includes WebAuthn and protocols for authenticators such as hardware security keys.

Why passkeys can resist phishing

A passkey is created for a specific website or app. In normal use, a fraudulent site using a lookalike address cannot obtain a valid passkey response for the real service. This origin-based design is a major difference from passwords and one-time codes, both of which can be entered into a deceptive page.

That does not make account takeover impossible. Malware on an unlocked device, stolen browser sessions, compromised email accounts and deceptive recovery requests can still cause harm. Passkeys also cannot stop a person from approving a transaction they do not understand. Their important benefit is narrower: they reduce the risk of handing a reusable login secret to a fraudulent website.

Device-bound and synced passkeys

Passkeys are not all stored in the same way. A device-bound passkey stays on one authenticator, such as a phone, computer or hardware security key. This can provide a strong physical boundary, but access may be harder to restore if that device is lost and no backup has been planned.

A synced passkey can be made available on a user’s other devices through a platform account or password manager. This approach is intended to make device replacement less disruptive. Major platform providers and password managers support passkey synchronisation in different ways.

Providers commonly describe their synchronisation systems as end-to-end encrypted or otherwise designed so passkeys are protected during storage and transfer. Users should nevertheless understand the practical trade-off: synchronisation can improve recovery, while making the security of the main synchronisation account and its recovery settings especially important.

Some services also allow cross-device sign-in. A computer without the relevant passkey may display a QR code, allowing the user to approve the login from a nearby phone. Exact steps differ by platform, but these flows generally use local device unlocking and proximity checks to limit remote misuse.

Support is growing, but it is not universal

Passkey support is available across major phone and computer ecosystems and is broadly supported by modern browsers through WebAuthn. Password managers can also help users manage passkeys across devices and, in some cases, across operating systems.

Service-level adoption remains uneven. Some consumer and workplace services offer passkeys as an option, while others still require passwords, retain passwords as a fallback or limit passkey support by product, account type, location or app version. A passkey option on one device does not necessarily mean every sign-in route supports it.

Before removing a password or changing recovery settings, users should check the service’s current security documentation and account controls. Important accounts may require more than one sign-in or recovery method.

Account recovery is the difficult part

Lost phones, broken screens, forgotten device PINs and inaccessible cloud accounts are ordinary problems, not rare exceptions. People may also share devices, lack a spare phone, have unreliable connectivity or need workplace access restored after an employee leaves.

A secure system needs a way to restore access without making impersonation easy. Services use different recovery methods, including recovery codes, verified email, phone-based checks, backup authenticators, customer support and pre-registered security keys. Each has advantages and risks.

• Recovery codes can be effective when stored securely offline and separately from the account they restore.
• Email recovery may be practical, but it shifts security to the email account.
• SMS recovery is widely available but is generally less resistant to phishing and phone-number takeover than phishing-resistant methods.
• Customer support can help in exceptional cases, but support staff may be targeted through social engineering.
• Backup security keys or devices can provide a stronger fallback when they are registered in advance and stored safely.

The question is not whether recovery should exist. It must. The question is whether recovery requires enough evidence, safeguards and, where appropriate, delay to make fraudulent account recovery difficult.

What users can do before a device is lost

• Register passkeys on more than one trusted device if the service permits it.
• Secure the account used to sync passkeys with strong device protection and carefully reviewed recovery settings.
• Store recovery codes offline in a secure location rather than only inside the account they restore.
• Use a password manager and unique passwords for services that still require passwords.
• Review recovery phone numbers and email addresses, particularly after changing providers, moving or losing access to an old address.
• Consider backup hardware security keys for high-value accounts where supported.

Password fallback can weaken the benefit

Many services retain passwords because of legacy systems, user expectations or incomplete recovery processes. That is understandable during a transition, but password fallback can preserve familiar risks. If an attacker can bypass a passkey by selecting a password-based sign-in or reset route, the account may still be exposed to password reuse, credential stuffing and phishing.

Services should decide which sign-in and recovery methods are appropriate for different account risks. A retail account and a workplace administrator account may not need identical controls. For sensitive accounts, recovery should be protected as carefully as the primary sign-in process.

Security guidance from organisations including the US National Institute of Standards and Technology and the UK National Cyber Security Centre has emphasised phishing-resistant authentication. Passkeys and hardware security keys can support that goal when they are implemented well. They do not, however, fix weak help-desk procedures, unclear recovery rules or poor account design.

Access and usability matter

Passkeys can make account security easier for people who are repeatedly targeted by phishing or struggle with password rules. They may also reduce the need to remember complex credentials.

However, a system built around personal smartphones may be difficult for people using older devices, shared computers, public access points or limited connectivity. Some users cannot rely on fingerprint or face recognition, so accessible alternatives such as a device PIN must be clear and usable. Others may not have a stable phone number, cloud account or spare device.

Services should support multiple authenticators, provide understandable recovery options and avoid assuming that every customer owns a recent personal phone. The goal should be fewer secrets to remember, not fewer people able to use essential online services.

What comes next

The next stage of passkey adoption is not simply adding more passkey buttons. It is making credentials portable, understandable and recoverable across devices and account ecosystems. Hardware security keys will remain useful where a stronger physical boundary is needed. Synced passkeys will remain attractive for many consumers because recovery and convenience affect whether people adopt secure tools.

Progress will depend on clearer cross-platform options, consistent recovery practices and services that reduce password fallback without leaving users locked out. Providers also need to explain what is stored where, what happens after device loss and which support channels can change account access.

Passkeys are not only about removing a familiar line of text. They are part of a wider redesign of online identity, in which devices, cloud accounts and recovery methods all become part of the security boundary. The cryptography is established. Building recovery systems that are secure, accessible and understandable may be the harder task.

Image by Lucas Seebacher on Pexels.