Passkeys Explained, and How to Switch Password Managers

Passkeys are the biggest change to how we sign in for years. Instead of typing a password, you confirm with your fingerprint, face or device PIN, and the site checks a cryptographic key behind the scenes. They are easier to use and much harder to phish.

Password managers are central to this shift, because they can store your passkeys and sync them across every device you use. This guide explains how passkeys work, where to keep them, and how to move to a new password manager without losing anything.

What a passkey is

A passkey is a pair of cryptographic keys created when you set one up on a website or app:

• The public key is stored by the website. It is not secret.
• The private key stays with you, in your device's secure storage or in your password manager.

When you sign in, the site sends a challenge. Your device signs it with the private key after you approve with biometrics or a PIN, and the site checks the signature with the public key. Your private key never leaves your device or vault, and there is no shared secret for a hacker to steal from the website.

Why passkeys resist phishing

A passkey is tied to the real website address it was created for. If a scammer sends you to a lookalike site, your device simply will not offer the passkey. That removes the most common way accounts are stolen: tricking people into typing their password into a fake page.

Where to store your passkeys

You have two main choices:

1. Your device platform. Apple, Google and Microsoft can store passkeys and sync them within their own ecosystems. This works well if all your devices come from one company.
2. A password manager. A cross-platform manager can store passkeys and sync them across Windows, Mac, iPhone, Android and every major browser.

If you use a mix of devices, a password manager is usually the more flexible choice. Here is how the managers we review describe their support:

On phones, check that your operating system lets your chosen manager provide passkeys. On iPhone, for example, you choose your password manager in the AutoFill settings.

Passkeys do not replace passwords yet

Plenty of sites still only offer passwords, and many that support passkeys keep a password as a backup. For the next few years you will likely use both. That is one reason to keep everything in one password manager: it fills passwords where needed and offers passkeys where available.

A few practical tips:

• Add passkeys to your most important accounts first, such as email, your main cloud account and anything financial, if those sites support them.
• Keep a recovery method for each account, such as a backup email or recovery codes.
• Do not delete your password from a site until you are confident the passkey works on all your devices.

When it makes sense to switch password managers

Common reasons to switch include a security incident at your current provider, a free plan being reduced, wanting a family plan, needing apps for a new platform, or wanting better passkey support. Our password manager rankings compare the options, and free vs paid password managers helps if cost is the reason.

How to switch password managers safely

Moving your vault takes about an hour for most people. Follow these steps:

1. Set up the new manager first. Create the account with a strong, unique master password, turn on two-factor authentication and save the recovery details.
2. Clean up the old vault. Delete obvious duplicates and dead accounts. It is easier to tidy before you move.
3. Check what your new manager can import. Most managers have import guides for popular rivals and accept CSV files. Some support direct or encrypted imports.
4. Export from the old manager. Use its export feature. Choose an encrypted export format if both apps support one; otherwise you will get a readable file.
5. Import into the new manager. Follow its import steps, then check a sample of logins, secure notes, cards and folders. Attachments and some custom fields may not transfer and might need to be moved by hand.
6. Handle passkeys. If both managers support moving passkeys, use that. If not, sign in to each site with a passkey and add a new passkey from your new manager, then remove the old one in the site's security settings.
7. Move two-factor codes carefully. If your old manager generated two-factor codes, make sure they imported correctly, or set two-factor up again for each account before you delete the old vault.
8. Delete the export file securely. An unencrypted export contains every password in plain text. Delete it, empty the trash and make sure it was not synced to a cloud folder.
9. Switch off the old manager. Uninstall its browser extension to avoid conflicting autofill, then cancel the subscription and turn off auto-renewal. Keep the old account for a short while in case something did not transfer, then delete it.
10. Turn off browser password saving if you no longer want your browser offering to save passwords alongside your manager.

Common mistakes to avoid

• Leaving the export file lying around. It is the most sensitive file you will ever create.
• Deleting the old account too soon. Give yourself time to notice anything missing.
• Running two autofill extensions at once. They can fight over login fields and cause confusion.
• Forgetting family members. If you are on a family plan, plan the move for everyone in the household.

The bottom line

Passkeys make signing in faster and far more resistant to phishing, and a cross-platform password manager is the easiest way to use them on every device. If you are switching managers to get better passkey support or a better plan, set up the new one first, import carefully, rebuild passkeys where they do not transfer, and securely delete your export file. To understand the encryption that keeps all of this safe, read how password managers work.