The Door Key That Lives in Your Pocket: A Sensible Sceptic’s Guide to Passkeys

Passkeys have spent the last few years being sold as the thing that will finally kill the password. In 2026, that sales pitch is getting louder: banks, shops and government services are nudging UK users towards a login that relies on a fingerprint, a face scan or a device PIN instead of a string of characters you half-remember. The idea is good. The reality is messier than the brochure. This is a guide for anyone who wants the convenience without sleepwalking into a lockout.

What a passkey actually is

A passkey is not your face. It is not your fingerprint. Those are just the trigger. Under the bonnet, a passkey is a pair of cryptographic keys: one held by the service, one held by your device. When you sign in, your device proves it has its half without ever sending a secret over the internet. Your biometric data stays on your phone or laptop; the website gets a mathematical nod, not a copy of your chin.

That is genuinely better than passwords in one important way: there is no reusable secret to phish. A fake login page cannot steal a passkey the way it can steal a password and a one-time code. It also means fewer of those maddening resets every time a service decides your password is too old.

The bit the adverts skip: your phone is now part of the login

The awkward truth is that a passkey turns your phone, tablet or laptop into a physical thing you need. That is fine until the thing is lost, stolen, dropped in a puddle or upgraded. What happens next depends on where the passkey lives.

If it is synced through iCloud Keychain or Google Password Manager, it may reappear on a new device signed into the same account. If it is device-bound — held only on one handset — it will not. Some services let you use a nearby device to approve a login; others will simply ask you to re-enrol. The practical rule: before you add a passkey to anything important, find out whether it syncs and whether you have another way in.

This is not a reason to reject passkeys. It is a reason to treat them like a spare key rather than a magic trick. A spare key is useful only if you know where it is and how to use it when the main one is stuck in the door.

Upgrade day is the new password reset

Changing phones used to mean moving photos and contacts. With passkeys, it can mean moving your front door. Most people will be fine: the big platform accounts usually carry passkeys across when you sign in on a new device. But ‘usually’ is doing a lot of work in that sentence.

If you use a password manager that supports passkeys, check how it handles export and recovery before you rely on it for your bank. If you use the built-in keychain on your phone, make sure you know the account password and have two-factor authentication set up. And if a service offers a recovery code, print it or write it down. A screenshot in your camera roll is not a recovery plan.

Where a backup login still makes sense

For low-stakes accounts — a shop loyalty scheme, a streaming service, a forum you visit twice a year — a passkey on its own is perfectly reasonable. If it breaks, you can make a new account or send a grumpy email. No harm done.

For the important stuff, keep a fallback. That means email, banking, your password manager, and anything connected to government services. A fallback does not have to be a permanent password sitting in a notebook. It can be a long, unique password stored in your password manager, plus a second factor, plus recovery codes kept offline. The point is not to mistrust passkeys. The point is to avoid a single point of failure that lives in your coat pocket.

Be wary of services that make SMS the only backup. SIM-swap fraud is still a real problem, and a text message is not a strong second lock. If a bank or government service offers an authenticator app or a recovery code as well, use it.

The shared-device problem

Passkeys work best when the device belongs to one person. On a family iPad or a work laptop, that assumption gets shaky. A passkey tied to your account should not be left available to whoever picks up the tablet next. Use separate user profiles where you can, and do not enrol a passkey on a device you do not control. If you are signing in on a friend’s phone, look for the option to use a passkey from your own device rather than creating one on theirs.

A calm checklist before you switch

• Start with one low-risk account and see how it behaves.
• Check whether the passkey syncs across your devices or stays on one.
• Keep a strong password and a second factor as a fallback for important accounts.
• Store recovery codes somewhere offline and findable.
• Test the login on a second device before you delete anything.
• For banking and government services, read the recovery process before you need it.
• Do not rely on SMS alone as your backup.

The verdict

Passkeys are a real improvement, not a magic wand. They reduce the damage a phishing page can do, and they make logging in less tedious on a good day. But they shift the risk from ‘what you know’ to ‘what you have and can unlock’. For most UK readers, the sensible approach is gradual adoption with a grown-up backup plan. Your face is not the password. Your device is the key — and even the best key deserves a spare.