Published: · by kodewright
Passkeys Explained: Should You Use Passkeys in 2026?
Should you use passkeys? Yes, for your email and main accounts first. What a passkey is, which accounts to switch, and what happens if you lose your phone.
Yes, you should use passkeys, starting with your email account and your phone's main account (Google, Apple or Microsoft). A passkey replaces typing a password with the same face, fingerprint or PIN check you already use to open your phone. It can't be phished on a fake site and there's nothing for a hacked website to leak. Keep your old password and recovery codes for now, though, and set up recovery before you need it. That last part is what most "switch to passkeys" guides skip.
What a passkey is, in one paragraph
A passkey is a pair of digital keys. When you create one, the website keeps the public half and your phone or password manager keeps the private half. Signing in, your device proves it holds the private half after you confirm it's you with your face, fingerprint or PIN. Apple puts it this way: the server never learns what the private key is. Two things follow from that. A breach of the website exposes nothing anyone can sign in with, and a passkey made for google.com simply won't work on a look-alike phishing page, because your device checks the real web address before it answers.
They're no longer an experiment. The FIDO Alliance, the industry group behind the standard, estimated in May 2026 that about 5 billion passkeys are in use, and that 75% of people it surveyed have turned one on for at least one account.
Which accounts to switch first
Go in this order, because each account protects the ones below it:
- Your email. Whoever controls your inbox can reset every other password. In a Google Account it's under Security > Passkeys and security keys.
- Your phone's main account (Google Account, Apple Account, Microsoft account), if it isn't the same as your email.
- Your password manager, if you use one and it offers passkey sign-in.
- Bank and payment apps that offer them.
- Social accounts (Instagram, Facebook) and shopping sites.
You don't need to switch everything in one evening. The first two cover most of the damage a hacked account can do; my guide to what to do when an account is hacked shows why the email always comes first.
Before you start, open the Passkey Checker on the phone or computer you'll use. It tells you whether that browser and device support passkeys and the autofill prompt. The check runs in your browser and nothing about your device is sent anywhere; if you try the optional test passkey, it's thrown away right after.
What happens if you lose your phone
This is the question that decides whether passkeys are safe for you. A passkey lives in a "keychain" that copies it to your other devices, and getting that keychain back onto a new phone needs something you have to set up in advance:
| Where the passkey is saved | Copied to | On a new device you need | The trap |
|---|---|---|---|
| Apple (iCloud Keychain) | Every Apple device on the same account, end-to-end encrypted | Apple Account password, a code to your trusted phone number, and the passcode of one of your old devices | Only 10 tries at that passcode, then the backup is destroyed. Add a recovery contact in advance |
| Google Password Manager | Android phones, and Chrome on computers and iPhones | The screen lock of an old Android phone, or your Google Password Manager PIN | The PIN can't be reset on Android, only on the computer or iPhone where you created it |
| A separate password manager | Every device where the manager is installed | Your master password (plus the manager's own 2FA) | Forget the master password and the passkeys go with it |
| A hardware security key | Nothing, it stays on the key | The physical key | Lose it and that passkey is gone. Register two keys |
The pattern across all four rows: the passkey is only as recoverable as whatever opens the backup. If you're on Apple, know the Apple Account password and set a recovery contact. On Google, write down the Password Manager PIN when you first create a passkey on a computer and store it with your other recovery codes.
Switching ecosystems got easier too. Since iOS 26, Apple's Passwords app can move passkeys to and from other password managers using the FIDO Credential Exchange standard, so a passkey made on an iPhone no longer locks you into Apple forever.
Why I'd keep the password for now
Most sites that offer passkeys still keep your password as a fallback, and many let you sign in with it whenever you choose "try another way". That fallback can still be phished, so adding a passkey doesn't close the door on its own. I'd still make the switch, because it changes your daily habit: if you sign in with a passkey every day, a page that suddenly asks for your password is a warning sign you'll notice.
What I'd do with the fallback password is make it long, random and stored in a password manager, so you never type it from memory. The Password Generator makes one in a second. Where a site lets you remove the password entirely after adding a passkey (some, like Microsoft accounts, do), do it only once you've confirmed you can sign in from at least two devices.
Personally, my passwords live in the browser's built-in manager and in Psono, so for me the question is always which of those holds the passkey. Pick one home for your passkeys and stick to it, so you know which keychain you need to recover after losing a phone.
When passkeys aren't the right call yet
I'd hold off, or keep the password as your main method, in two cases:
- You share a phone or a computer account with someone else. Anyone who can open the device can use the passkeys on it.
- You own a single device and haven't set up any of the recovery options in the table above. Losing that one phone would lock you out of more than a forgotten password ever did.
In every other case, the trade is good. For a comparison of passkeys with SMS codes and authenticator apps, see 2FA vs MFA, and for the Google and Apple settings screens, how to secure your Google Account and Apple ID.
FAQ
Can someone who has my phone use my passkeys?
Only if they can get past the phone's lock screen. Each passkey sign-in asks for your face, fingerprint or the phone's screen-lock PIN. If someone knows your PIN, they can use your passkeys too, so a 6-digit PIN that your family has seen you type is a real weakness.
Can I sign in with a passkey on someone else's computer?
Yes. Pick the option to use a phone or another device, scan the QR code with your phone, and confirm with your face or fingerprint. The passkey stays on your phone. Bluetooth has to be on for both devices, because the phone checks that it's physically near the computer.