Passkeys Are Finally Usable. Here Is What Actually Changes

I switched every account that offered it over to passkeys six months ago. Not as an experiment — I was tired of a password manager holding 340 entries I would never audit. Here is the honest report.

What a passkey actually is

A passkey is a key pair. The private half never leaves your device; the public half sits on the site''s server. When you sign in, your device proves it holds the private key without ever sending it. There is nothing to type, nothing to reuse, and nothing useful for an attacker to steal from the server.

That last part is the real shift. A leaked password database is a catastrophe. A leaked passkey database is a list of public keys, which is about as dangerous as a list of email addresses.

What genuinely improved

• Phishing basically stopped working on me. A passkey is bound to the real domain. A convincing fake login page cannot prompt for it, because the browser will not offer a key that does not match.
• Sign-in got faster. Face unlock, then in. No autofill fumbling, no "your password manager needs to update" dialog.
• I stopped thinking about password strength. There is no password to be weak.

What still breaks

It is not seamless yet, and pretending otherwise does nobody a favour.

• Account recovery is the weak point. Most sites still fall back to email, which means your email account is the master key whether you like it or not. Secure that one properly.
• Moving between ecosystems is awkward. Passkeys sync inside Apple, Google or your password manager — crossing between them is improving but still fiddly.
• Coverage is patchy. Banks have been slow. A lot of smaller services still offer nothing.

Where to start

Do not try to convert everything in an afternoon. Turn passkeys on for the three accounts that would hurt most if lost — your email, your password manager, and whichever account holds your money. Keep the password as a fallback until you trust the recovery path. Then add new ones as sites offer them.

Six months in, I would not go back. But treat it as a better front door, not a finished house.