What Is a Passkey? (And Do You Still Need a Strong Password?)
Last updated: September 2026
You've probably been asked to create a passkey on a growing list of sites, and it's worth knowing exactly what a passkey is before you do — how it differs from a password, and the question most explainers skip: whether the strong password you generated for that same account still matters.
What a passkey actually is
A passkey is a digital credential that replaces a password with your device's fingerprint, face scan, or screen lock. When you create one, your device generates a matched pair of cryptographic keys: a public key that's stored on the website's server, and a private key that never leaves your device. Logging in means your device proves it holds the private key, without ever transmitting anything a server breach could expose.
Passkey vs. password
| Password | Passkey |
|---|---|
| A secret string you (or a generator) create and must protect | A cryptographic key pair; nothing secret is ever typed or transmitted |
| Can be phished by a convincing fake login page | Bound to the real site's domain — a phishing site can't trick your device into using it |
| Vulnerable if the service's password database is breached | The service only ever holds your public key, which is useless to an attacker on its own |
| Works the same on any device once you know it | Tied to a device or synced through a passkey manager (iCloud Keychain, Google Password Manager, or a third-party manager) |
Do you still need a strong password?
Yes, in most cases — and this is the part most passkey explainers leave out. A few reasons:
- Not every account offers passkeys yet. Adoption is growing fast but far from universal. Every account still on a password needs a strong, unique one.
- Most services keep the password as a fallback. Even after you set up a passkey, the underlying account password usually still exists and can often still be used to log in, especially during account recovery — so a weak password there is still a real risk.
- Passkeys don't cover every kind of security you need. A device PIN, a Wi-Fi password, a shared family login — plenty of everyday credentials aren't going passwordless anytime soon.
The practical takeaway: adopt passkeys wherever a service offers them, and keep generating strong, unique passwords for everything that doesn't — including the fallback password behind your passkey-enabled accounts.
Frequently asked questions
Can I still use my password if I have a passkey?
Usually, yes. Most services keep the password active as a fallback sign-in method even after you set up a passkey, particularly for account recovery. That's exactly why the password still needs to be strong.
What are the downsides of passkeys?
They're tied to a device or a passkey manager, so losing access to both without a backup can lock you out. Support also varies across sites, browsers, and operating systems, so the experience isn't fully consistent yet.
How do passkeys work across devices?
Passkeys can sync through a passkey manager (like iCloud Keychain or Google Password Manager) so they're available on your other devices, or you can use a nearby device with a QR code to sign in somewhere your passkey isn't stored.
Is a passkey free?
Yes — creating and using a passkey doesn't cost anything. It uses security features already built into your phone, computer, or browser.