Passkeys vs Password Managers: Do You Still Need Both?

The one-line answer

Passkeys replace passwords for sites that support them. Password managers hold passkeys, plus everything a passkey cannot cover: the account that is still password-based, the recovery codes, the secure notes, the payment cards, the older internal tools that will never support WebAuthn. In 2026 the right answer is still both. The question is just how you divide the labour between them.

What a passkey actually is

A passkey is a cryptographic credential defined by the FIDO2 and WebAuthn standards. When you “create a passkey” for a website, your device (or your password manager) generates a public-private key pair specific to that site's origin. The public key goes to the site. The private key stays with you.

Signing in is a challenge-response flow. The site sends a random challenge. Your authenticator signs it with the private key. The site verifies the signature against the public key it stored at registration. No shared secret ever travels over the wire. No passkey “leak” is possible in the way a password leak is, because the site only ever held half of the cryptographic material.

Three properties follow from that design and matter in practice:

• Phishing-resistant. The passkey is bound to the exact origin it was created for. A look-alike site cannot ask for it and will not receive it.
• Breach-resilient on the server side. If the site gets breached, attackers get public keys. Those are not useful without the matching private key, which the site never had.
• No secret to type. You cannot be socially engineered into revealing a passkey the way you can be talked into reading out a password.

What a password manager still does

Password managers have been the pragmatic answer to password reuse for two decades, and they are not obsolete. As of mid-2026 they still handle most of the credential workflow for a typical user:

• Store passwords for the long tail of sites that do not yet support passkeys — which is still most sites.
• Store passkeys for the sites that do, so the passkey travels with the rest of your credentials rather than living in a single platform silo.
• Store recovery codes, TOTP seeds, SSH keys, API tokens, secure notes, and credit card data.
• Offer secure sharing for families, teams, and inherited access.
• Run client-side password audits: reuse detection, breach monitoring, weak-password reports.
• Enforce strong generation and phishing-resistant fill on non-passkey logins.

Some of those jobs could eventually be covered by platform tooling. But right now, the password manager is the only piece of software that sees the full credential surface.

Where they overlap

The interesting overlap is passkey storage and sync. Every major password manager now supports creating, storing, and syncing passkeys: 1Password, Bitwarden, Dashlane, Keeper, NordPass, Proton Pass, and even Apple and Google's own platform managers. The same is true for WebAuthn-based TOTP replacements and security key registration flows.

In practical terms, a modern password manager can be your primary passkey home. The flow is:

• A site offers you a passkey.
• Your password manager extension or app intercepts the WebAuthn prompt.
• It creates the passkey inside your encrypted vault.
• The passkey syncs across your devices with the rest of your vault.
• On sign-in, the same extension or app intercepts the challenge and signs it.

This is the architecture most people should use. It keeps all credentials in one system, under one master password, with one recovery plan.

The four places a passkey can live

Knowing where your passkeys are is half the battle with cross-device friction. There are four homes a passkey can land in.

1. Apple passkeys — synced via iCloud Keychain. Seamless across iPhone, iPad, and Mac. Available to non-Apple devices only via QR code hand-off.
2. Google passkeys — synced via Google Password Manager. Seamless across Android and Chrome. Available on other platforms via Chrome.
3. Microsoft passkeys — synced via Microsoft Authenticator and Windows Hello. Seamless across Windows and Edge.
4. Password manager passkeys — stored inside your cross-platform password manager vault (1Password, Bitwarden, Dashlane, Proton Pass, etc.). Available anywhere the manager's client or extension runs.
5. Hardware security keys — YubiKey, Titan, Feitian. Passkeys bound to a physical device, typically not synced. Highest security, lowest convenience.

Most people accidentally end up with a mixed state: a passkey for their bank in iCloud, one for GitHub in 1Password, one for Google in Google Password Manager. That is survivable but fragile. Recovery gets complicated when one of those homes is unavailable.

Picking a primary home for your passkeys

The right answer depends on what your devices look like:

The worst outcome is “wherever the prompt happened to offer.” Decide once. Use that home consistently.

What stays in a password manager even in a passkey-first world

Even if every online service you care about supported passkeys tomorrow, the password manager still has work:

• Passwords for non-WebAuthn systems. Home routers, older business tools, utility companies, many streaming services, any legacy app with baseline auth.
• WiFi passwords and network share credentials.
• SSH keys, GPG keys, API tokens. These have their own auth flows and will outlive passkey rollout.
• Recovery codes and backup factors for every account.
• Secure notes — insurance details, passport numbers, one-time codes.
• Payment cards and billing details. Autofill with per-site scoping is safer than browser-wallet defaults.
• Breach monitoring and reuse detection. Passkeys solve phishing; they do not solve credential hygiene across your existing passwords.

Risks and limits of passkeys today

Passkeys are the right long-term direction, but the rollout is not finished.

• Coverage is uneven. Major platforms and a growing set of services support passkeys. A long tail of sites does not.
• Cross-ecosystem hand-off can be awkward. Signing in on an Android phone to a site where your passkey is in iCloud involves a QR code dance. Usable, but friction is real.
• Recovery flows vary. Some sites still fall back to a password or SMS OTP for account recovery. If those are weaker than your passkey, your real security ceiling is the fallback, not the passkey.
• Account impersonation via synced credentials. If an attacker takes over your iCloud or Google account, they inherit your synced passkeys. Protect the sync account with its own strong auth.
• Device loss without backup. A passkey that lives on only one physical device with no sync and no second authenticator is a single point of failure.

None of these are reasons to avoid passkeys. They are reasons to add a second authenticator, pick a home with sync or a clear backup plan, and keep a password manager for the rest of your credential life.

A practical setup for 2026

If you want a concrete plan, this is the one we recommend for most households:

1. Pick a primary password manager. Cross-platform if you have mixed devices. Enable a strong master password and multi-factor authentication.
2. Make the password manager the default passkey home. On sites that offer passkey registration, let your manager intercept and store them.
3. Register a second authenticator on critical accounts. A hardware security key, or a passkey in a second platform, stored somewhere durable. Critical accounts are: email, password manager, identity provider, banking.
4. Turn on passkey-first sign-in everywhere it is offered. For every service that supports passkeys, make the passkey the primary factor and remove the password if the service allows it.
5. Audit legacy passwords. Use your manager's reuse and breach reports. Rotate anything reused or known-compromised.
6. Write a recovery plan. Where your recovery codes live, how a trusted person reaches your vault in an emergency, what your second authenticator is.
7. Disable SMS-based recovery where you can, especially on email and banking. SIM-swap attacks remain a real and low-effort attack path.

Checklist: is my setup actually safer than last year?

• ☐ At least one passkey registered on email, banking, and identity provider accounts.
• ☐ A second authenticator on every critical account (hardware key or second device).
• ☐ Password manager with a master password 20+ characters that exists nowhere else.
• ☐ MFA on the password manager account, ideally a hardware key.
• ☐ Auto-fill on page load disabled.
• ☐ Recovery plan written down and accessible without the password manager (yes, on paper somewhere safe).
• ☐ Breach monitoring turned on. Recent alerts triaged.
• ☐ SMS-based recovery disabled on email and banking where possible.
• ☐ A clear default passkey home, not four scattered ones.

The bottom line

Passkeys are real, they are better than passwords for the use cases they cover, and they are worth turning on wherever they are offered. Password managers remain the tool that pulls the whole credential life into one place — passkeys, passwords, TOTP seeds, recovery codes, and shared vaults. They complement each other; they do not compete.

The 2026 goal is not to pick one. It is to put passkeys everywhere you can, use strong unique passwords where you cannot, and host both inside a password manager you trust and have a recovery plan for.

Related reading: Are password managers safe? · What to do after a data breach · VPN logging policies explained.

Frequently Asked Questions