I hope it won’t become mandatory. (I honestly doubt).
Until device attestation is removed or strongly curtailed in the spec, I suggest you do not create any Passkeys. Which sucks, because it's otherwise a pretty cool tech.
[1] https://passkeys.dev/docs/reference/known-issues/
More sources here: https://www.smokingonabike.com/2025/01/04/passkey-marketing-...
Passkeys are basically session cookies that are signed by a secure element in one of your devices at the time you log in. That's it. They cannot be phished because there is no password to steal. If I had to guess, the basic flow is something like this:
1. When the passkey is created, the device's secure element coughs up a public key or something to the server representing itself as a trusted device
2. When a user logs in, the server issues a challenge (basically a random number) to the device and says "sign this with a private key that corresponds to one of the trusted public keys I have"
3. The secure element signs the challenge and sends it back
4. The server goes through its list of trusted device public keys until it finds one that verifies the challenge response. If it finds one, it logs you in. If it doesn't, you don't log in
Step (1) is probably bootstrapped with a username/password and second factor like SMS 2FA, OTP, or email 2FA.
Even if this isn't exactly how they work, it's a plausible implementation. Nothing about this requires vendor lock-in. The various secure elements that can produce passkeys come from many different places, so I'm sure sufficiently motivated open source people could create a firmware TPM that is certified for use with passkeys or something if they cared enough.
The only observable outcome of each of these changes has been making these products less convenient for us to use. At this point I don't think I am alone in being knee-jerk opposed to any further "improvements." I have yet to see a website make a case for a passkey being more convenient than what it is replacing, so I will continue opting out of them as long as I am allowed to.
As someone with ADHD a passkey is something I can lose easily and I don't want my accounts to be tied to any specific device. What if I have to upgrade my laptop tomorrow because one I use got bricked? Sounds like an absolute nightmare.
Password on the other hand I can remember for dozens of services, each very long.
The one thing I would ding that approach on is recoverability, though. If a fire burns that down, it's gone.
You can’t use any random password-manager with passkey support.
I use Bitwarden for everything and have to have MS Authenticator installed just for this 1 login.
Super annoying.
Additionally this puts the same players in control of your logins - want to sync your passkeys? - enable "iCloud Keychain", or some other 'trust me bro' app that will 'securely store/sync your data' - no thank you.
In perfect world users should be able to generate a certificate, upload it to a couple nfc capable ubikey like devices that blow a fuse afterwards preventing from additional writes/reads and use that to login to every app ever. You would buy such devices in packs of 3, upload same cert to all, hide the other, burry the third.
Passkey biometrics also allow you to confirm certain person is holding the device right in this very moment, and not receiving a TOTP via walkie-talkie. Especially important for kinetic sanctions.
If you check out their Terramare group of companies those guys are still using typewriters. Unless you're US/UK millionaire I recommend to stay as analog as possible with physical password book and TOTP/yubikey.
Same with the push for "post-quantum crypto" and elliptic curves. I feel my systems get significantly more attention when using 8k RSA than any of its modern replacements. While I love wireguard the transition to ED25519 felt way too smooth..
And if the pros are using typewriters in 2026 it's not a signal for me to put even more eggs into the US-megacorp dominated basket who treat me like an NPC who can be droned at will.
That is not the case. The entire setup/enrollment/add a passkey to your account processing is DMV inspired.
I get reluctance about being dependent from the US but your reason seems a bit off
I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use LastPass. If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices? Is there a way to ensure that passkey can be used on other devices? Can I add another passkey on another device? How many passkeys can I set up for a particular site/app? I have at least 6 different combination of browser/devices in use.
I don’t want to use Passkeys because I don’t the answers to those questions, and I don’t know whether each website/app that has set up Passkeys has decided the answers to those questions in the same way as the others. For now, I’m going to stick with LastPass and use Passwords; because no matter whether I lose my device or not or whether I’m on my own devices or not, I can be sure I’ll be able to get into a site/app.
Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option?
However, this negates the primary stated objective of passkeys, removing the possibility of users being phished, so I'm not sure how long that will remain the case everywhere.
I've also encountered sites that have a login with passkey prompt that then turns around and asks for TOTP 2FA or email confirmation anyway, which to me seems to negate the primary customer benefit of passkeys...
My non-technical friends are extremely confused by passkeys and if they should use them and how to use them and I honestly don't have very good answers. It is a mess. I don't believe an inherit mess, but one created by the companies and projects trying to take advantage of the new system.
(But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.)
The weird part is that password managers provide no way for you to copy and paste your passkeys. To present a passkey, you have to use a password manager. This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you).
Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself. Instead, the password managers each have their own finicky app-to-app mechanism for transferring passkeys from one password manager to another. (I think all the password managers kinda like that lock in.)
Finally, note that for logging into your password manager itself, you'll always require something outside your password manager to login, probably a password, but possibly a YubiKey; your choice. (It's your one "last password," as they call it.)
https://danfabulich.medium.com/passkeys-are-just-passwords-t...
P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.
The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion).
Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is a good article with screenshots showing the confusion: https://arstechnica.com/security/2024/12/passkey-technology-...
I have senior citizens asking me about passkeys because their bank and medical websites keep reminding them about switching to passkeys every time they login into their accounts. My recommendation to them is not to do it unless they have a simplistic single vendor setup such as only Apple iPhone and MacBook with iCloud Passwords app. If instead they have a mixed Windows + Apple setup with 3rd-party password manager, they could accidentally put a new passkey into the os or browser instead of their external password manager and not realize what has happened. This happens because the different parties implementing passkeys all have different agendas that suits their interests and that's what makes the workflow confusing for normal people.
> But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices
That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone. And that's just the first of the family sharing passwords issues. Same person issue is also present if somebody uses an iphone and a windows laptop, or chromebook.
It doesn't help that all modern browsers eagerly try to step in and offer their implementation of passkeys for logins, and they're not featured enough to support the type of shared access or synced access many people would expect from a password manager. How useful is your firefox passwords on an iphone? Or Mac OS's keychain I use as a daily driver on my windows gaming desktop?
> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself
This is wrong. Every single major password manager supports export. Lastpass, 1password and bitwarden all do that.
> It's past time to move off of LastPass. LastPass lost all of your passwords again last month
That just isn't true. Last month, their third party customer support portal was breached. That did not involve passwords.
ITS NOT SIMPLE AT ALL
1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing).
2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers
3. The vision for collaboration never materialized so everyone went their own way to implement it. Examples would be google rolling out browser (Chrome) managed authentication which led to this situation where even on the same machine you have to remember which browser you used to create the Passkey credential.
4. Interestingly enough the earlier popular name was WebAuthn, Apple started calling it Passkey on fly, given Apple's popularity everyone just caved in.
5. My personal interpretation is that in some sense Apple wanted to be the default password manager on Apple devices.
6. This is when all password manager companies jumped in strongly to save their business and the protocol went into a direction where you can use your existing password manager to store the credential/Passkey as well
Personally its a mess, the phishing resistant aspect has its own benefits though. If you are using it with security in mind then my recommendation would be to use a hardware backed security key with NFC enabled. Everything else is pretty much lipstick on pig, they are worse than passwords in some sense from usage perspective.
It's a nice simplifying step to talk about password managers here, but in the majority of the cases this won't be handled by a password manager, but rather by the device operating system, and the device manufacturers really like that lock in.
They're also in an especially good position to abuse it, because they now know every service that you authenticate and the webauthn "attestation object" field lets them set up a side channel with those services such that they can sell additional information about you.
Some people will tell you that the attestation object is not used in the consumer passkey system, so there's no way for this abuse to occur, but since it's usually going to be the device manufacturer who controls the password-manager-like component here, and they're the ones who stand to profit most from this kind of abuse, I think we need stronger guarantees than "the spec says you shouldn't do this unless the user is your employee and you paid for their device".
Until they fix this, I'm sticking with my mess of TOTP authenticators and yubikeys.
The main feature of passkeys is that they can't be pasted into a website they shouldn't be pasted in to. That means you can't copy them, by design.
The big risk with passkeys is storing the passkey where it will be held hostage. Don't store it in most single-ecosystem devices like Apple. Bitwarden can export, and I think 1Password can as well.
That's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons.
> P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.
That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use <whatever> instead" list.
For core security tool class, that doesn't inspire confidence.
It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential management.
Security folks would like to pretend "solving continuity" isn't a problem, or is a problem that doesn't need to be accessible.
Lets say it is a android phone. Open amazon app. login in the usual user/password + 2FA (like with QRcode or phone). create passkey. done. This passkey would have been now synced to your google account.
Take next spouse phone. Open amazon website or app. try login it will try for passkey but cannot find it. so
- login in the usual user/password + 2FA (like with QRcode or phone). create passkey. done - Now this passkey would have synced to spouse google account.
In future, assuming you have apple or windows laptop. assume you have signed into Google (chrome). Now go to amazon. It will ask - shall I sign in with passkey. Yes, give your macos fingerprint or windows hello or password of that laptop. login Done magically. You dont even need to remember username or password.
Assuming you both have iPhones. You can sync the passkey to icloud account. And for every new iDevice it will be available.
The main bottleneck of passkey would be that all 3rd party sites will have another non-passkey way as backup to login. I have never seen a website that would say - remove all other methods and keep only passkey.
In a way passkey is 99% convenience. If a hacker would some how get your sms and password they can by-pass.
there's. it depends on how the site implemented passkeys.
I'm using multiple devices and passkeys via keepassXC. I haven't lost access or even got locked out of any accounts.
but it's like 2FA, and almost all sites have a clean fallback (backup codes) for 2FA.
I think the reason is because I've anchored passkeys into my understanding of how 2FA works, and the pain of migrating 2FA from one phone to another.
So, I don't want to bother with it.
I can safely write down a password on a piece of paper and keep it somewhere phyisically safe.
Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.
those that don't have this built-in (eg. KeePassXC) recommend using Dropbox or some external sync mechanism
but the keys are stored in a file, which you can back up.
> all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor
no, not at all. it still gives you better UX, because when you use the passkey you know it's the site you want to log in to. (because there's mutual authentication.)
Why is there so much misinformation nonsense around passkeys?
How do you generate a new key if you need one? Same process as a password reset. Does it prevent session stealers? Not at all.
Its "benefit" is grandma can't read it to an attacker. OK, well can grandma click a link and have a session stealer bork her life instead? Yeah, and attackers know that and just shift methods. Session stealing isn't a sophisticated attack, and so all that's being done is shaving a cost on PW resets in the interest of shareholder value, at the cost of security theater and locking up your keys in a single domain that holds control over our access to everything.
As a bonus, I self host using the open source vaultwarden[1] server implementation, which is packaged in alpine linux.
[0] https://bitwarden.com/ [1] https://github.com/dani-garcia/vaultwarden
Linux is the only oddball here, I had issues getting this flow to work.
If the UX for Passkey improves, I will go all-in on it, I'm at the point I'd love to just completely block passwords from accessing my account, unless I explicitly enable it temporarily by logging on via passkey, I wish some sites would let me lock my account to this level, it would be better. Passwords feel like they just wind up all over the web.
Weirdly enough you can store multiple passkeys for a given domain, which can get confusing in some cases if they dont have normal names tied to them.
Edit: Originally I thought Passwords from Apple was iOS / macOS only, but its not! So I have been editing my original message, sorry for the confusion, I had forgotten that I can login on Windows with my Passkeys from Apple's ecosystem.
As another poster noted, you can transfer them out of Apple's ecosystem too!
Take a guess why.
Passkeys are just a trick for vendor lock-in disguised as a security practice.
> A Public Key Credential Source’s generating authenticator determines at creation time whether the public key credential source is allowed to be backed up. Backup eligibility is signaled in authenticator data’s flags along with the current backup state. Backup eligibility is a credential property and is permanent for a given public key credential source. A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential. See also § 6.1.3 Credential Backup State.
https://support.apple.com/guide/icloud-windows/set-up-icloud...
In my opinion it's a bad plan, because it elevates certain devices to privileged status, if you lose your phone you are hosed.
Passkeys should be allowed to be synced between devices and stored on password managers in the cloud. I am making my own password manager for my personal use, but have not delved into passkeys.
The device bound model also completely falls apart in the enterprise, fails to address shared devices and shift workers where employees share the same PC under the same OS profile, now you're back to needing good old fashioned SSO w/ physical MFA (Yubikey) to attest who the user is in addition to attesting the device itself.
Before synced passkeys, the actual standard is a unique key pair per device. The key pair on my phone shouldn't be synced to my laptop, my laptop should generate it's own key pair.
The second you have a second device to log in from they are useless. The second you want or need to share a credential (smart or not) they are more work than a password.
The passkey trend seems lead by platforms that want to make it easier to get or stay logged in, Netflix type companies that want to prevent account sharing, and those that value convenience (if one device) over security.
Worse, I'm still using LastPass -- but migrating over to Chrome password storage as it syncs between phone and laptop. LastPass doesn't give you the option to not use it for passkeys. It might be the thing that causes me to finish the migration away from it.
Now, is that the official stance? I don't know; but it's _absolutely_ what every current implementation suggests the companies deploying this stuff want.
You can make passkeys better. Like me, you can install a well-funded password manager (well-funded, because it needs the engineering effort behind it to keep up with the ever-changing passkey apis on every platform in the world; screw up and oos, can't log in today!). Then you have one passkey per remote service, and just have to make sure 1password is _always_ installed and perfectly integrated. Easy!
I currently only use passkeys for a few websites that have awkward password login workflows or do not autofill properly from my password manager. I just have a single passkey for each that is synced via Bitwarden. Currently, I see passkeys as using an electronic biometric lock on the front door while passwords are still regular locks on the backdoor. The biometric lock on the front door does not do much for security when the backdoor still exists and I have come across very few websites that support only allowing passkeys. And those that do still run into problem 2 listed above.
N=1 and I'm sure I'm holding it wrong, but I can only log in to ADP to request PTO from my personal laptop because I set up an iCloud passkey, work laptop does not allow access to iCloud keychain, and you can't request PTO from mobile.
I use ProtonPass and have made it the default password store on every device and browser. This way all passkeys get stored in proton and I can login from any other personal device with proton setup.
I think that's exactly the problem. These are all answerable questions, but getting those answers is confusing for most people.
Also, nothing says you have to delete passwords (or alternate means of logging in) if you already have them set up. Having multiple ways in will help prevent lockout.
Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passkey to sign in easier”? I set it up and now I can easily sign in to Amazon on my mac or iphone with zero friction.
For the normal consumer this is not a replacement for “dig out my password manager and copy-paste/autofill my password”, it’s a replacement for “oh it’s prompting for my password again” -> proceed to type your shared password for all sites.
Passkeys lock into a specific device and seem easy until you need to use another device.
But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems like a worse fix than existing tools for a problem that has better solutions.
Simple: it's like a password that I don't have to type in
Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices.
Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level. But before that, I was simply sharing passwords through 1Password in the exact same way. So, I don't think my security posture has changed any.
What has changed is the UX and IMO for the better. Now I don't have to generate/fill/copy-paste text strings for user names or passwords. 1Password knows what site I'm on and usually responds automatically when I'm in a passkey context. If I have more than one passkey available, because I have multiple accounts (for something like Google Workspace), it shows me options and I pick the one I want.
Honestly, it's mostly a "just works" system and I like it a lot better than passwords.
YMMV, of course.
Honestly, this is one of the two things that make me hate passkeys. The key management is a high-friction pain in the ass.
Software vendors continue to refuse to support, or even accept the existence of, this entire class of use cases for regular consumers (they are, however, more than happy to milk enterprises on convoluted implementations of those).
And now I have another thing I need to carry everywhere.
When I hit the button to log into Slack, there are like, 3 popups in succession - the last one ultimately asking for my fingerprint. Then when I give it, there is a flurry of web pages that get loaded and redirects that happen until finally Slack pops up again.
There isn't any realistic world in which I check each window to make sure everything is happening right and I am not being MitM'd.
I'm a fairly technical person, and I would be unable to perceive the difference between a really tight security environment and my computer being hijacked.
And of course, passkeys on most all sites don't really improve security since someone can just choose to login with user/pass instead since presumably very few sites allow you to have just passkey.
Also if you use a password manager you may get locked into using that platform. Or ideally using a third party one but then having to pay a subscription, or using an open source option that is not ideal for the average person.
If one uses a passkey as intended and without a password manager and the site truly only supports logging in via your passkey, for all the touted benefits of passkeys, that would be a nightmare if a person loses access to their device, etc.
You want anecdotes? Ok. I’ve had elderly adult relatives who aren’t good with their devices tell me unprompted they’re using them and like them when I mentioned the word out loud to myself using my phone around them.
These are people who don’t know the difference between apps and the web. Who have 200 tabs open because they don’t know what tabs are so a new one just gets opened automatically all the time. Can’t tell some websites apart. Who change their passwords on every login to some sites because they can’t get sign in right.
Yeah if you want to write them down or refuse to save passwords outside text files or demand they live on a security key on your keychain you’ll have a hard time. You’re being 0.0000001% of the user population. You’re not representative.
They are a MASSIVE UX win. A MASSIVE security win.
I’ve logged into my work computer with a passkey on my personal phone, no issue. It’s fine. They’re backed up locally. It’s fine.
The biggest problem, which is getting better and somewhat a transition problem, is sites using terrible UX to trigger the workflow. Those that follow the suggestions or close to it are great.
I love passkeys. I just don’t get the confusion.
She doesn't know how she created one, she doesn't know what it is, and I don't know how to explain to her that if her PC dies I won't be able to help her log back into her account. I'm not even sure how I'm going to migrate this thing to a new PC for her.
The average person doesn't know anything about this stuff nor do they care. I also have yet to see a Passkey solution that didn't also have a password on it and a nice little box letting people choose to use the password instead of the passkey. They just added a new layer on top of all the old ones and created confusion. Now people use password and passkey interchangably in conversations and no one knows what they are talking about.
https://github.com/keepassxreboot/keepassxc/issues/10407
https://news.ycombinator.com/item?id=47189749#47193048
My read on it all is that FIDO is stuck in some sort of groupthink. They don't feel the boots on the ground confusion around passkeys being opaque. They only care about phishing and being called "insecure" and don't care about anything else. Hence why WebAuthn has additional weird anti features like AAGUID for provider authentication.
Another one of those ridiculous threads is saying you gotta have support for nonsense like user presence verification.
My problem is that I manage a lot of accounts for my family which makes passkeys a nightmare. If I’m out and a kid gets chucked into a login flow that happens to require a passkey, I can’t text a password and TOTP code to the adult with them. I know that’s terrible opsec but the reality is people share accounts and passkeys are designed to thwart that.
One annoying thing though is that while they recently added password sharing, they don't allow sharing passkeys. Basic passkey sharing would be nice, but it also seems possible to implement fancy sharing features that wouldn't be possible with password sharing. Things like sharing one time use passkeys or time limited passkeys or limited access passkeys or secure revocation of shared passkeys. I hope people are thinking about this.
I thought I was the only one!
I can have the most complex password and create a passkey, but a windows machine could allow a 4 pin digit to access the passkey.
also appreciate your attitude, better than "I work in tech for xx year, i don't understand yy, so yy must be bad."
And many sites block paste from password managers. Passkeys have so many ways to do them wrong that we're going to see all kinds of new and exciting failure modes that lock you out of your account in the future.
And web site implementors couldn't follow that golden path, or describe the golden path, so there's fragmentation in usage and meanings and practices, making it far more confusing.
I love passkeys, I want to eliminate any and all password-based logins and switch entirely to passkeys. It's such a better experience, it's a "physical" key that can be backed up to multiple devices, and thinking of it like a key for a physical lock really gets at the core of its capabilities. But locks can be used in many many ways! Maybe you need to open the lock and still tell the guard a password, which is weird, but how most websites still operate.
And there's your blocker. Being limited to only devices from a single vendor is horrible, and a firm no from a lot of people.
> Now we can put on the tinfoil hat and say how this fosters vendor lock
The fact that you call it a tinfoil hat type issue is just insane to me. Literally every person in my household has some apple devices and some other ones (android, windows, etc). And some of them have switched back and forth.
Plus, the "ergonomics" of logging into a website on a random device to check something are awful.
What would you answer if grandma asked you what happens if she loses her physical key?
If you are confused about digital passkeys, you can use a physical yubikey or nitrokey and tap it when it blinks. You can treat them like a credit card or house keys.
Asking people to keep up with and remember passwords is and always has been the thing that was invented with zero understanding of the consumer brain.
Currently I save all login tuples to Bitwarden and store OTP secrets onto Aegis. Could have been 1password and authy, it's irrelevant. The thing is, I only get pwned if both are compromised.
Now with ubiquitous passkeys in Bitwarden if someone has access to my vault unencrypted it's already endgame.
You can't phish a passkey, and you don't rely on the user providing you 'hunter2' on every site.
As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet.
The UX on the other hand is not great. If you have a password manager, your OS may prompt you which target to store the passkey with.
I think Bitwarden is on HN's current happy list. (I just use Apple iCloud myself.)
Allowing passkeys to be exported to a plaintext file undermines the phishing protections, at least somewhat. It’s possible to trick you into exporting your passkeys from Bitwarden and sending the file to an attacker.
The major password managers say that this is the reason they don’t allow exporting passkeys, and it’s not false, but they’re also making it harder to switch password managers, which may be their ulterior motive. (You can’t even import those exported passkey files into any of the major password managers, which they would be incentivized to do, if those smaller players had significant marketshare.)
It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.
Quite complicated to get it all setup (definitely not for non-technical users), but both are GPL and I now have all my passwords available with hardware protection (yubikey on desktop, secure enclave on iOS) in all locations.
I had the same frustration, I ended up with Keepass, the store is a open spec db[0] that has several clients, I use it across windows, android, and Linux without any issue and just sync with your favorite file sync tool.
I've used pwsafe for years now. I think it checks off all your boxes. Works on desktop and mobile. Local-first but allows cloud if you really want to. No ads or enshittification. Bonus: Open Source. Other Bonus: Not owned by BigTech or LittleTechThatValuesMonetizationOverSecurity
Is writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.
Also yubikeys have limited passkey slots (100, 25 with old firmware)
To be fair, trusting users with passwords/credentials is how we got into the mess of phishing et al in the first place.
I hate that I can’t just put a value in a plain text file somewhere (encrypted, let’s say, to preempt the inevitable and low-value response) and rely on that to work when I need it on any device and interface that can accept keyboard input.
> If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?
Assuming you have LastPass set up to be an iOS password manager, and it fully supports iOS' passkey implementation: when you create a passkey in Safari, it will ask you if you want to store it in LastPass or in the iOS Passwords app (previously known as iCloud Keychain). If you say LastPass, then it's up to them, but I assume it'll sync to all your devices - it's how 1Password works. If you were to accidentally say Apple Passwords, it'll sync to all your Apple devices automatically, and you can either use Apple's password browser extension on Windows, or you can use the "another device flow" I'm about to detail.
> Is there a way to ensure that passkey can be used on other devices?
As mentioned above, passkeys are intended to sync via your password manager of choice as the primary use case. If for any reason you don't have that passkey synced to that device, _and that passkey is on a mobile device with a camera_, most browsers will give you the option to scan a QR code with your phone. This kicks off a flow that will authenticate you via your phone's biometrics or passkey, then use Bluetooth to first ensure device proximity and then handle the authentication exchange. In the case of iOS, this includes any passkey-supporting password manager, so the passkey itself can be in 1Password; it doesn't have to be in the iOS password system for this to work.
When I first read the above, my hackles were raised given how well Bluetooth operates at times; but every time I've used it so far, it's been fast and flawless. Still, I can see a lot of scenarios where this might not work - e.g., the first one I thought of was a public computer at a library where Bluetooth might be locked down; corporate computers or remote servers could also be troublesome. As far as I know, passkeys don't yet have answers to those scenarios; other than to just use your password + 2FA as you would without a passkey.
As far as I know, both of the above apply to every passkey-consuming site.
> Can I add another passkey on another device? How many passkeys can I set up for a particular site/app?
This touches on your last paragraph, where it indeed could change based on the website. In my experience, every website where passkeys are fully supported - e.g., not ones that are using passkeys as a substitute for FIDO/U2F keys - has let me add multiple passkeys and have not _appeared_ to have a limit. I typically will create a passkey in both 1Password and Apple Passwords just to have a backup, and I can't recall any cases where that's been a problem. Still, I can't say for sure that isn't a problem on any website.
I went all in on trying passkeys when they started to be an option, and I don't have any notable regrets. For me, passkeys have generally worked well when the site is designed to use them well; and at no point have they been a _major_ hindrance. That isn't to say there are _no_ annoyances, though:
- Most websites that support passkeys tend to use them as a replacement for both the password _and_ 2FA, which makes them more convenient. However, a few - Amazon being the most notable I can recall - only use them as a second factor, which just makes them feel a little useless.
- A passkey can _also_ be used as the proof of identity, meaning you can log in in one fell swoop and don't need to enter a username or email address, which is IMO the best showcase for passkeys. Like above, this makes websites that ask you to enter an email address before letting you use a passkey also feel annoying.
- Most web browsers I've used support the QR + Bluetooth flow I mentioned above (otherwise known as Hybrid Transport or caBLE) without issue; Linux has been the odd duck out. Firefox doesn't seem to support it at all on Linux, and Chrome-based browsers do but sometimes are missing what they need and in that case don't show it as an option. Since I sync just about every passkey with 1Password this typically isn't a problem; the exception is the passkey for Apple Accounts, which Apple creates automatically, and (AFAIK) doesn't allow you to enroll your own. Apple Accounts are the only service I've found that does this, though.
- Some websites seem to only offer passkeys as an option if you're on a mobile device, or at least did so at the time of enrolling. eBay and PayPal I think are the two that jump out at me as having done this. Why they did it this way instead of simply detecting if the browser supported passkeys, I have no idea.
All of the above issues have gone down over time, so it's generally been a net decrease in friction over time. And, at least as far as I can recall, passwords themselves continue to be an option in every instance I've enrolled a passkey. So if you like your passwords, generally speaking, you can keep them :P
None of my desktop computers support Bluetooth. Neither do my wife’s.
The sync was actually a compromise to the standard. The idea was unique, device-bound credentials. One person, one device. The private key/passkey on your phone should not be the same one on your laptop, or your tablet, etc. Each device was supposed to have it' own unique credential.
Allowing sync is a security downgrade to the standard, in terms of threat-model guarantees. Pure WebAuthn credentials should be sealed in hardware (TPM or Secure Enclave or equivalent) and be mathematically non-exportable which guarantees zero remote blast radius, an attacker must physically posses the device.
Allowing sync and storing passkeys in a password manager reintroduces cloud account compromise risk and recovery flow hijacks. You lose non-repudiation.
Still more secure than passphrase + TOTP, but doesn't eliminate account takeover attacks against your cloud credential vault, which purely hardware based, per-device credentials do.
Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your iCloud Keychain. Boom, now it is available across all of those
This is how it will work for most people who don’t care about security and just casually use their devices. My boomer mom does this. It’s better than the notebook full of handwritten passwords she was using.
You have chosen lastpass and a multi-ecosystem environment with windows and multiple browsers on each. You have chosen complexity and this is not a limitation of passsphrases as they have been designed for a more common use case.
I use Linux and apple. I have chosen protonpass for my vault. I just tell my OS to save the passkey there and everything works pretty well. If not, my password is right there as fallback. It’s really not that hard.
You're basically fucked even if you buy a new one because you need one of the other two to log in.
That really rubbed me the wrong way, and smacked very heavily of "the big players (MSFT, AAPL, GOOG) can do this - you can't".
The biometric verification also allows to confirm that a certain person is holding the device, and they can easily be matched to existing passport/travel databases.
Great system if the good guys have it, a bit problematic if it's abused by nepo kids to hide their crimes.
I use passkeys with a physical authenticator. How do "they" track and deplatform me with a single click? Can you explain?
If my phone's camera is broken but both devices have bluetooth, it can do the handshake over bluetooth.
If I'm on someone else's computer and I want to use a passkey on my authenticator on my keychain, I'll just plug it in and then tap the button on the authenticator.
Meanwhile, if I logged in with the password and the account only has a password then they have a full copy of my entire authenticator to the account. With the passkey, once the session is invalidated the access is gone.
Plus, that doesn't have the negatives/limitations of passkeys.
It’s not that difficult. Spend 10 minutes researching the topic and you’re fine. Passkeys are so much more convenient than having to use passwords. When implemented right, it’s literally one click from opening the login page to being signed in. On all of my devices.
As is, I had to either:
- Keep both on me, and add both - I am at risk of losing both at the same time
- Keep one one me, one in a safe - I have to keep track of which device I've added to which service, and periodically take the backup one out of the safe and iterate through the "new" services
I was never satisfied with either approach, so I ended up with an OTP app with backups.
Until I can tell Grandma to "go down to Walmart and ask the man at the electronics counter for a Yubikey", we still have a few issues.
(No. Ordering online is *not* a valid option in this scenario. If I want to order a Yubikey to this address at this exact moment in time and space, Amazon won't deliver one to me for at least six days at the earliest, based on their rural delivery estimate. Replacing a key is basically impossible.)
And if you're compromised in such a way that an attacker could steal your password then wouldn't they be able to just hijack your session instead?
Passkeys are just passwords that require a password manager; you can't login to a password manager without something outside the password manager, usually a password. (That's why they call it "LassPass" and "1Password"; there's one last password you'll still have to maintain.)
No password manager tries to get you to login with a passkey without setting a password, for precisely that reason. Apple, Google, and Microsoft do invite you to login to their password managers via passkey, because it's convenient and unphishable, but they always also allow you to login via password (or "backup codes", which are just backup passwords).
What if the robber hits you in the head and you get brain damage and forget your password?
Or straight up betrays you (you slighted them at some family event)
well, people are talking about it but it's not making a difference https://lucumr.pocoo.org/2025/9/2/passkeys/
The document there is laughable too, because KeepassXC is listed as "not performing User Verification" when it demands manual authorization per request. But this isn't good enough for the passkey people. Ultimately, I see any FOSS option being effectively banned from most services and all important ones. It's a parallel to how you must now be on Cloudflare's nice list or be banned from the majority of the internet.
> [When UV is required, KeePassXC must request user verification or not handle the request]
> This implementation is not spec compliant and has the potential to be blocked by relying parties.
It would, if the people implementing it weren't all so obsessed with pushing their own platform-specific solutions over enabling open standards. LastPass works fine on Android, iOS, Mac, and Windows, but each one of those platforms defaults to saving passkeys in their own platform-specific store unless you jump through hoops to specifically save them somewhere else.
They all support exporting passwords, but, check your CSV; you won't find any passkeys in the CSV export for Apple, Google, Microsoft, Mozilla, 1Password, or LastPass.
(Bitwarden, Proton Pass, and KeepassXC do support exporting passkeys to CSV, which undermines the phishing protections, at least somewhat. It’s possible to trick you into exporting your passkeys from Bitwarden and sending the file to an attacker. It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.)
> How useful is your firefox passwords on an iphone?
Did you try it? That's the primary feature of the Firefox app for iPhone.
(Especially since the Firefox app for iPhone is just Safari's WebKit wearing a Firefox disguise.)
> Or Mac OS's keychain I use as a daily driver on my windows gaming desktop?
https://apps.microsoft.com/detail/9pktq5699m62?hl=en-US&gl=U...
> With the iCloud for Windows app, you can access photos, files, passwords, and other important information from your iPhone or other Apple devices on your Windows PC.
When Apple's your password manager, you use Apple's password manager app to synchronize passwords and passkeys.
There. You just violated the premise of his point, that you use a password manager that syncs to all your devices.
The passkeys sync just fine between iOS and Android on our devices using 1Password.
Edit:
Oh yeah, I can also share SSH keys with friends and co-workers. I can freely choose which SSH key to use when authenticating and I can have an arbitrary number of SSH keys for a given server on each machine. Some of this stuff is esoteric, but some is not. Most of the stuff I can do with SSH keys I can also do with passwords but not with passkeys (or at least not always). Finally, as many others have mentioned, the attestation stuff is really ugly and takes control away from the user entirely.
https://f-droid.org/en/packages/org.liberty.android.freeotpp...
Also since the service does not store your private key, it is more resistant to data-breaches as that is one less potential breach source.
I would love for this feature to actually work but every time I've needed it to it hasn't. Literally this week I only had a passkey on my phone, but at the time I was in Linux with Firefox, and afaict the qr code workflow basically requires either chrome or windows 10.
In fact, if you have your Apple Passwords app set to sync through iCloud, you can:
- Make a passkey on your Mac for a site in the Passwords app
- Go to a different computer (a friend's or whatever)
- Attempt to log in, choose use another device, it'll show the QR code
- Use your iPhone to scan that QR code and sign in, as the iPhone has the passkey synced through iCloud
Note, the same kind of thing is also possible with other password managers as well.
If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password.
In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time.
And, remember, seniors could also put a randomly generated password into the wrong password manager. In that case, they'll either have to reset their password, or they'll have figure out what they did, retrieve their password from the OS password manager, and transfer that password to their preferred password manager.
The exact same story applies to passkeys, except, because passkeys can't be copied and pasted, you'd have to figure out how to use the finicky app-to-app transfer system ("Credential Exchange Protocol"). That's probably too complicated for most seniors, so falling back to a password is almost certainly their best bet.
Maybe... I just ran into an annoying scenario where the largest bank in Canada made an administrative error where they mislinked an account belonging to me to my wife's profile.
I went to a physical branch to get it fixed and was told that branches don't have that kind of ability so I'd have to call customer support.
I called customer support and failed the verification questions because the expected answers were wrong, based on their own clerical error. After failing the verification questions, I just got a "we have to end this call, no additional information can be provided, please visit a branch."
I was able to get around it by calling back in and providing the incorrect, but expected answers to pass the verification step - I imagine, however, that this could have turned into a real nightmare for seniors, or anyone who wasn't able to deduce what the expected verification answers were.
In the UK at least, there are very few brick & mortar branches anymore - banks expect everything to be done online.
You can click "try another way" and use your password, and then you'll have access to your bank. But then, you should try to resolve that problem. If you (or a trusted friend/family member) can figure out how to use settings to remove the passkey from your bank's account settings, you can do that, or you can ask a bank teller to help you, instead.
(And, luckily, you won't need a bank teller, because you'll still have access to your account.)
Isn't this true of any authentication method? It doesn't seem unique to Passkeys.
Nobody fucking knows.
BitWarden, KeePassXC, and probably a bunch of other password managers have very thorough support for import-export, automatic/periodic backup, sync/merge, etc.
Multiple pieces of software vying to be your passkey provider, often using dark patterns so you don’t realize you’re making a choice, and not using the term “passkey” so people are using the technology without knowing what it is or how to research it.
Kind of reflects the state of the web today, where every company wants to be your intermediary in every interaction, from making a purchase to transcribing a meeting.
With the "cloud password manager" angle there is some hope of being user friendly, although we're certainly not there yet for most folks.
- Only one specific device can ever login (bad).
- It doesn't limit login to one specific device, therefore it does nothing.
Linking Passkeys to a physical device was always DoA. At least not without a way to enroll every device you own, and strong recovery strategies. But considering how inconsistent every company's Passkey implementation is (inc. many that only allow ONE TOTAL!), it is DoA.
(I.e., Yubikeys and other USB sticks.)
It works fine and it a no-brainer to use.
The problems start when vendors start trying to shoehorn their shitty cloud auth services into WebAuthn.
For example, all the major sites that allow the total of 1 active TotP authenticator app - trying to add one forces to delete the other. Which is fine while you have only one phone and aren't in the process of switching to another one.
The annoying thing is so many services don't even support TOTP. They either want their own proprietary app, still insist on SMS, some of them even try to get you to use voice prints!
It's the same answer when someone asks 'how am I supposed to have a different password for every site' and 'how am I supposed to remember a password of X+ characters.' Use a password manager. Pretty sure every major one supports passkeys by now.
ETA: Well I do use auto-fill in browsers/mobile, but funny thing about this, I have three running on my phone[0], they all activate at the same time, and they contain mostly non-overlapping set of credentials, and I got tired of trying to sync them together, so I just look up passwords manually one by one in each and use clipboard to transfer the credential once I find it.
And I had to stop using passkeys because they interact with this split-brain system in unpredictable ways.
--
[0] - Specifically: Google Password Manager / Google Autofill / whatever they call it, Samsung Pass / Samsung Wallet (they're sort of but not the same?), and auto-fill built into Firefox.
I have a "Family" group in my Passwords app where I share passwords and passkeys with family members for exactly this purpose.
At virtually all banks, the bank tellers cannot help you with login problems. You will have to call the bank's tech support and somehow navigate AI-modulated phone menu hell.
Edit:
Apparently BitWarden should work, but my particular passkey was not on there.
Excuse me? The infrastructure for "an apps is trying to login with a private/public key pair, and right now it needs the private key to encrypt some part of the transaction" has existed on Linux since it began.
The problem, as best as I can understand it, is that some/all browsers are not treating passkeys as an extension of the key system that began with ssh(1), even though technically speaking, they are.
If that wasn't the intent they could have make the thing work like ssh keys, encrypted at rest, you can take them wherever you want.
What they want is to lock your identity to your android and/or iphone devices.
Additionally passkeys allow services to detect and ban specific password managers, so have fun when the only approved managers that works consistently across all services are Google/Apple/Microsoft. There is already a list of "bad" clients here https://passkeys.dev/docs/reference/known-issues/