I don't like passkeys | Ethan HawksleySkip to contentHome Blog← BlogI don't like passkeysBy Ethan Hawksley18th September 20264 min readFor the past few years, the tech industry has kept pushing passkeys as the ultimate solution to logging in. Many Big Tech companies “helpfully” inform you every time you sign in how much easier and effortless passkeys are. The only way to make them stop is either to concede and set up a passkey or dig into the settings to find the off-switch.Google goes as far as to name the setting “Skip password when possible” (opens in a new tab), and Microsoft advertises that you should make your account passwordless (opens in a new tab).Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen. If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.This leads to passkeys being the perfect fit for a corporate environment, but a poor fit for personal security. To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on. If these recovery methods aren’t enabled, then the risk of permanent lockout remains for the user.Hardware keysBy design, you cannot create a backup of passkeys on a hardware key: passkeys can only be added or deleted but never moved. Instead, you need to purchase 2-3 hardware keys and enroll every key for every site. This can quickly get expensive and doesn’t scale well as the number of accounts starts to grow.Hardware keys support discoverable credentials, where websites can query for your username instead of you typing it in. These are becoming increasingly popular amongst website developers, yet have limits of 25-100 accounts (opens in a new tab)per hardware key, and top of the line keys can have up to 300. Once you exceed the limit, you must either delete some accounts or you have to buy another set of hardware keys.Synced passkeysBoth Apple and Google want your identity anchored to their operating systems. The “happy path” on their devices is to use their synced passkey management tied to your Apple or Google account. If their automated systems decide one day to ban your account (opens in a new tab), you irreversibly lose access to all your passkeys used across all third-party accounts too.The FIDO alliance has been working to improve interoperability and make it easier to export passkeys, but the experience is still fragmented and inconsistent across providers. This is set to improve over the coming years, but currently it is too immature to rely on. Compare with a password, which is just a string you can easily export by hand if necessary.Third-party synced passkeysWhen storing passkeys in a password manager like Bitwarden (opens in a new tab)or KeePassXC (opens in a new tab), you end up fighting the platform. Although operating systems have recently introduced APIs (like Android’s Credential Manager (opens in a new tab)) for third-party tools to hook into, the experience remains fragmented and lacks the decades of UX polish towards password autofill. Autofill outside the browser and inside native applications remains especially inconsistent. In the future, I believe third-party passkeys will be the way forward, but we are not there yet.When passkeys don’t workLogging into accounts on devices you own is the ideal scenario for passkeys. When you have to handle a colleague’s computer, it gets much more inconvenient. You could plug in a hardware key, but you don’t always have access to the ports. You could sign in and use a synced passkey, but that involves trusting the computer to not leak all of your other passkeys. The last option is to use “Hybrid Transport” (opens in a new tab), where you scan a QR code and connect via Bluetooth simultaneously to the computer. Whilst this option is secure and works in theory, reality is plagued with edge-cases where connections fail or Bluetooth is straight-up unsupported.Passkeys aren’t ready yetI believe enterprise users have good reason to use passkeys, but the ecosystem isn’t mature enough yet for individuals.Whilst TOTP codes have known phishing vulnerabilities, the recovery and lockout risks of passkeys pose a greater day-to-day risk to most people than an AiTM proxy (opens in a new tab). A combination of randomly generated passwords stored inside a third-party password manager, paired with an independent TOTP app, gives control to the user without giving up the flexibility of plain text. For users who previously reused passwords across all their sites, passkeys are a huge step-up. For everybody else, it is currently a step back.Written by Ethan Hawksley, a computer science student at the University of Warwick and author of The Second Maintainer.Keep up to dateOccasional emails when I publish new writing or projects. Prefer feeds? Follow via RSS.Email addressSubscribeThanks, now just check your inbox to confirm!Something went wrong. Please try again.←PreviousHow to get a free .arpa domainAll posts© 2026 Ethan Hawksley·Source (opens in a new tab)·RSS·PGP·Elsewhere

Passkeys have been heavily promoted across the technology industry as the definitive solution for authentication, often presented by major companies as effortlessly superior to traditional passwords. While passkeys offer significant security benefits, their implementation presents critical trade-offs, particularly when considering the landscape of personal security versus corporate utility. Passkeys are inherently secure against phishing attempts because they are bound to the specific website they are created for, and their asymmetric nature means they cannot be recovered directly from server-side details following a data breach. However, this security advantage is offset by the greater risks associated with access management, as the security of an account remains dependent on less secure recovery methods such as SMS, email, or security questions. This creates a false sense of security because the threat shifts from man-in-the-middle attacks to permanent account lockout, automated bans, or device loss, which stand as greater day-to-day risks for the individual user.

The concept of hardware keys introduces further complexities. By design, hardware keys cannot be backed up or moved; they must be enrolled individually for each site, which creates significant logistical and financial burdens as the number of accounts increases. While hardware keys support discoverable credentials, which allow websites to query usernames, these systems are currently limited in scalability, often restricting a single key to a specific number of associated accounts. Furthermore, the synchronization of passkeys between operating systems, such as those provided by Apple and Google, anchors identity to the device ecosystem. This creates a potent vulnerability where an automated account ban initiated by the service provider could consequently result in the irreversible loss of access to all associated passkeys across third-party accounts.

Efforts toward improving interoperability, championed by the FIDO alliance, are addressing the fragmentation of the passkey experience, but this maturation is still pending, leaving current solutions inconsistent compared to exporting a simple password. The management of passkeys stored in third-party solutions, such as password managers, highlights ongoing friction. Although operating systems have introduced APIs for third-party tools to interact with credential management, the user experience remains fragmented and inconsistent, lacking the polished experience seen with traditional password autofill. While the author suggests that third-party syncing may eventually be the preferred route, full realization of this potential remains an unfulfilled prospect.

The scenario of actual login presents further challenges. While logging into accounts on personal devices is ideal for passkeys, situations involving shared access, such as handling a colleague’s computer, introduce friction. Options like using a hardware key or relying on synced passkeys introduce additional layers of complexity, potentially compromising user control over their credentials. Even a theoretically secure method like Hybrid Transport, which uses simultaneous Bluetooth and QR code connections, is plagued by practical failures due to unsupported connections or unforeseen edge cases.

Ultimately, the author concludes that while passkeys offer substantial benefits, the ecosystem is not yet mature enough for widespread individual adoption. The inherent risk of permanent account lockout, coupled with the recovery difficulties, poses a greater immediate threat to most people than man-in-the-middle attacks mitigated by passkeys. The author proposes that for users who have previously engaged in password reuse across multiple sites, passkeys represent a significant security improvement. For the general population, the current state is viewed as a step back. Therefore, the proposed alternative involves a combination of storing randomly generated passwords within a third-party password manager and pairing them with an independent Time-based One-Time Password application, which allows users to maintain control over their accounts without sacrificing the flexibility of plain text credentials.