Passkeys and password managers both help people protect online accounts, but they solve slightly different problems. A passkey lets you sign in using a cryptographic credential tied to a device or synced account, often with a fingerprint, face scan, or device PIN. A password manager stores and fills unique passwords, and many managers now also support passkeys.
What is a passkey?
A passkey is designed to resist phishing because the credential is associated with the legitimate website or app. You generally approve sign-in on a trusted device rather than typing a reusable password into a page. Depending on the service, passkeys may sync across devices or remain tied to a particular device. Recovery options vary, so set them up before you need them.
What does a password manager do?
A password manager creates and stores strong, unique passwords for different accounts. This reduces the risk that a breach at one website will expose the same password used elsewhere. A manager can also help identify reused or weak passwords and store secure notes, depending on the product.
Do you need both?
For many people, yes. Use passkeys wherever reputable services support them, and use a trusted password manager for accounts that still require passwords. The manager may also store or synchronize passkeys. The best combination depends on the service’s supported sign-in and recovery options.
Set up account security in this order
- Secure your primary email first. Email often controls password resets for other accounts. Use a passkey or strong unique password and enable multifactor authentication.
- Choose a reputable password manager. Review independent security information, recovery procedures, device support, export options, and pricing before moving your vault.
- Replace reused passwords. Prioritize email, financial accounts, cloud storage, shopping, and social media.
- Enable passkeys where available. Start with important accounts and verify that you understand how to sign in from a new device.
- Protect recovery access. Keep recovery codes in a secure location and ensure your account recovery email and phone number are current.
- Turn on device updates and screen locks. Account security also depends on protecting the phone or computer that approves sign-ins.
Common mistakes to avoid
- Using one password across multiple websites.
- Saving recovery codes in an unprotected screenshot or shared note.
- Assuming every passkey automatically works on every device.
- Ignoring the security of the email account used for recovery.
- Installing a password manager from an advertisement without checking the publisher and official download source.
If you suspect an account has been compromised, use the service’s official recovery process, sign out other sessions where possible, review recovery details, and check recent activity. Our broader cybersecurity essentials guide also explains foundational account-protection habits.
Official guidance
Read CISA’s guidance on strong passwords and FIDO Alliance information about passkeys. These explain the security principles; always review the current features and recovery terms of the specific service you choose.
Featured image: Person using a laptop and phone, photo by Dan Nelson via Unsplash.
