Tech giants push passkeys hard

Google and Microsoft aggressively promote passkeys as the future of login, with settings like "Skip password when possible" that users must actively disable to stop the reminders.

Passkeys solve phishing perfectly

Passkeys are bound to specific sites and use asymmetric cryptography, making them immune to phishing attacks and data breaches that expose traditional passwords.

“Passkeys are a fantastic technology.”

But individuals face different risks

For personal users, the real threats are permanent account lockout, automated bans, and device loss. Passkeys reduce phishing risk but increase these more likely scenarios.

Hardware keys don't scale

Hardware keys cannot back up passkeys and store only 25 to 300 accounts each. Users need multiple keys for every site, which gets expensive and impractical quickly.

Platform lock-in threatens everything

Apple and Google tie synced passkeys to their accounts. If either company bans your account, you lose access to all passkeys across every third-party site permanently.

Third-party tools still immature

Password managers like Bitwarden can store passkeys but lack the polish of native implementations. Autofill remains inconsistent, especially outside browsers and in native apps.

Passkeys fail on shared devices

Using passkeys on someone else's computer is risky. Hardware keys need ports you might not have, synced passkeys expose all your other accounts, and Bluetooth hybrid mode has unreliable edge cases.

Stick with passwords for now

For most people, randomly generated passwords in a third-party manager plus a separate TOTP app offers better control and flexibility than passkeys until the ecosystem matures.

“For everybody else, it is currently a step back.”