Online account security can feel complicated because new terms appear quickly. Two useful options are passkeys and password managers. They solve related but different problems: passkeys let supported services verify you without a traditional password, while password managers securely store and generate passwords for accounts that still use them. For many people, using both is a sensible approach.
Image: Carl Barcelo / Unsplash
What is a passkey?
A passkey uses cryptographic credentials associated with a website or app. You usually approve sign-in with your device’s screen lock, fingerprint, face recognition, or another supported method. The service stores a public key while the private key is protected by your device or passkey provider. Exact behavior depends on the platform and account setup.
Passkeys can reduce risks from reused passwords and fake sign-in pages because the credential is designed for the legitimate service. They do not eliminate risks from stolen unlocked devices, compromised recovery channels, or unsafe account settings.
What does a password manager do?
A password manager creates and stores unique passwords so you do not have to memorize each one. It helps replace reused passwords with long, random ones and can fill them into the correct sites. Choose a reputable provider, protect the vault with a strong master credential and multifactor authentication where available, and understand how account recovery works.
Which should you use?
- Use passkeys when trusted services offer them.
- Use a password manager for accounts that still require passwords.
- Keep recovery email and phone details current.
- Enable multifactor authentication, especially for email, finance, and administrator accounts.
- Save backup codes somewhere secure rather than in an unprotected photo gallery.
Seven practical security steps
- Secure your primary email first because it often controls password resets.
- Replace reused passwords, starting with important accounts.
- Turn on passkeys where practical.
- Enable multifactor authentication and save recovery codes.
- Keep devices, browsers, and apps updated.
- Review active sessions and revoke unfamiliar devices.
- Never approve a login you did not initiate or share a one-time code with a caller.
If your phone is lost
Before changing devices, understand your provider’s sync and recovery process. If a device is lost or stolen, use official security tools to revoke sessions and lock or erase it where appropriate. Navigate to services through their official apps or known addresses instead of unexpected links.
The takeaway
Passkeys and password managers are complementary tools, not competing magic solutions. For standards-based background, consult the FIDO Alliance passkeys guide and NIST Digital Identity Guidelines. If you are checking suspicious login messages, also read our guide to spotting online scams. Adopt passkeys where practical, use unique passwords elsewhere, protect recovery methods, and keep devices updated. Features differ by provider, so follow official documentation for your accounts.