Passkeys Are Here: Do You Still Need a Password Manager?

What a passkey actually is, and why it is not just a fancier password

A password is a shared secret: you type the same string a site stored a hashed copy of, and if they match, you get in. A passkey is a cryptographic key pair created by your device. The site keeps your public key. The matching private key never leaves the authenticator (your phone, your laptop, or a password manager vault), and sign-in happens by signing a one-time challenge with it (SentinelOne).

The standards behind this are FIDO2 and WebAuthn. WebAuthn is the browser API the site talks to; CTAP is what the browser uses to talk to the authenticator; the passkey is the credential they exchange (Descope). The important security property is origin binding: the browser only releases a signature for the exact domain the passkey was registered against, so you cannot be tricked into handing one over to a look-alike site. That is what makes passkeys phishing-resistant in a way no password can be.

Two flavors exist. Synced passkeys live in a sync fabric (iCloud Keychain, Google Password Manager, a Microsoft account, or a third-party password manager) and follow you to a new device. Device-bound passkeys live on one authenticator (a YubiKey, a specific phone) and die with it. Consumer sites almost always use the synced variety (Authsignal).

How much of the web actually runs on passkeys in 2026

Headline numbers are strong. The FIDO Alliance's 2026 consumer and workforce report put consumer familiarity at 90% and said 75% of people have enabled a passkey on at least some account, with 68% of large organizations deploying, piloting or rolling out passkeys for employees (FIDO Alliance). The Passkey Index, which pools data from 15 large consumer services including Amazon, Google, Microsoft, PayPal, TikTok and WhatsApp, found 36% of successful sign-ins on those platforms now use a passkey, up from 26% a year earlier, though the FIDO Alliance notes the year-on-year number is directional because the participant pool grew from 9 to 15 (Start With Identity).

Those figures are concentrated at the top of the web. A February 2026 census of the Tranco Top 100K by researchers at the University of Surrey found around 9,400 domains with some passkey support, roughly 11% of the scanned set, and many of those still require a password for the primary step and treat the passkey as a second factor (arXiv).

Translate that into your own account list. The big consumer services you log in to every day probably support passkeys. The cable company, the state tax portal, the HOA billing site, the twelve-year-old forum you still read, the SaaS tool your team pays for, the legacy VPN at work: most of those still run on passwords, and most will for years (Specops Software). Even services that rolled out passkeys usually keep a password on the account as a fallback for recovery.

• FIDO Alliance (Oct 2026): around 7 billion active passkeys worldwide
• 90% consumer familiarity, 75% have enabled a passkey on at least one account
• Tranco Top 100K census (Feb 2026): about 9,400 domains with any passkey support, ~11% of the set
• Workforce: 68% of large organizations are deploying, piloting or rolling out passkeys

Every major password manager now stores passkeys

This is the piece most comparisons bury. The leading password managers are no longer about passwords. They are vaults for whatever credential the site demands, and all of the major names now generate, store, sync and autofill passkeys alongside logins. Bitwarden's help center documents passkey creation, storage and autofill across its browser, desktop and mobile clients (Bitwarden), and its 2026.9.2 rollout in September 2026 put passkey storage, autofill, passkey login and passkey vault unlock on the free tier (SafePasswordGenerator). 1Password, Dashlane, NordPass, Proton Pass, Keeper and RoboForm all support passkey creation and autofill across their desktop, mobile and browser clients (Cybernews).

The practical gain is cross-ecosystem portability. If you create a passkey in iCloud Keychain on an iPhone, moving it to a Windows PC or an Android tablet is still clunky. If you create it in 1Password Individual or Bitwarden Premium, it works the same way on every device where that vault is signed in. For households and teams, that is the whole argument.

Portability between managers is finally catching up too. The FIDO Alliance's Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) were developed through the Credential Provider Special Interest Group, whose members include 1Password, Apple, Bitwarden, Dashlane, Google, Microsoft, NordPass and Samsung. Android shipped CXP support through Google Play Services 26.21 starting in June 2026, and iOS 26 followed in September with Bitwarden among the first managers to implement it (Bitwarden) (FIDO Alliance). Transfers are end-to-end encrypted and require a biometric check on both devices. Until CXP, moving a passkey vault between providers was essentially impossible, which effectively locked your credentials to whoever you first created them with.

The practical read for anyone shopping in the Best Password Manager 2026 list: passkey support is now table stakes. The differences between vendors are elsewhere, in sharing, admin controls, encryption audits, mobile polish and price.

Are passkeys more secure than storing passwords in a password manager?

For the moment of sign-in, yes, and it is not close. Password-based attacks make up more than 99% of the roughly 600 million identity attacks Microsoft logs each day, and passkeys are structurally immune to phishing and credential stuffing because the private key never leaves the device and the browser enforces the origin check (ITPro). The FIDO Alliance says passkey sign-ins succeed more often than passwords and traditional MFA and complete nearly three times faster on the services it tracks (FIDO Alliance).

A vault full of strong, unique, randomly generated passwords plus TOTP is a long way behind a passkey on the phishing front. A good vault stops password reuse, which is still the single biggest driver of account takeover, but it cannot stop you from typing your bank password into a convincing look-alike domain. A passkey can.

The honest caveat is account recovery. At FIDO's Authenticate 2026 conference, speakers described recovery as the new control plane for account takeover: a phishing-resistant passkey does not help if the site lets you reset with an SMS code or a password. In Corbado's Passkey Benchmark 2026, 69% of surveyed authentication teams still fall back to passwords when users lose their passkeys, 47% to MFA codes, and 35% to a help desk call (Corbado). A passkey account that falls back to SMS has the phishing resistance of SMS. That is a policy problem on the service's side, not the passkey's, but it matters when you compare real accounts rather than ideal ones.

Should you drop your password manager and just use passkeys?

Not in 2026. Two things get in the way. The first is coverage. If you audit your real credential list, most of it will not have a passkey option, and you still need somewhere to keep those passwords and their 2FA codes. The second is lock-in. Using only iCloud Keychain or only Google Password Manager means your passkeys follow you cleanly inside that ecosystem and become awkward the moment you cross into another one. That is survivable for someone with one phone and one laptop from the same vendor. It is painful for anyone on a mixed Windows and iPhone setup, anyone switching platforms, and most families and teams.

A third-party password manager sidesteps both problems. You use the manager's passkey storage for the sites that support them, you keep passwords in the same vault for the ones that do not, and the vault syncs the same way across every device whether the owner is on macOS, Windows, ChromeOS, iOS or Android. For a household, 1Password Families or Keeper Security Family gives each person a private vault plus shared folders. For a solo user who does not want a subscription at all, Bitwarden Premium at roughly $10 a year or Bitwarden's free tier covers most of this.

Teams have it worse without a manager. Passkey sharing across shared service accounts is still uneven between managers (Cybernews). On the enterprise side, legacy infrastructure is the larger issue: a lot of corporate IT still runs on on-premises Active Directory and isolated legacy systems where passkey support is somewhere between hard and impossible (Specops Software). Business buyers looking at the Best Password Managers for Teams & Businesses 2026 list will see the stronger picks (like Keeper Security Enterprise and 1Password Business) treat passkeys as one credential type the vault handles, not as a replacement for everything else.

Will passkeys replace passwords completely, and if so, when?

Eventually, almost certainly. On the schedule most people expect, no. The curve is steep at the top of the web: the FIDO Alliance projects adoption keeps climbing as Apple, Google and Microsoft push synced passkeys by default, and most of the large services it surveys say they plan to let employees go fully passwordless within a year (FIDO Alliance). But the long tail is deep. The web outside the top 100K sites moves slowly, enterprise software even more slowly, and governments, banks, utilities and health systems keep passwords as a fallback for recovery and for customers who cannot (or will not) use biometrics.

That means a realistic consumer path looks like this: your most-used accounts (email, cloud, retail, bank) move to passkeys first and stay that way; the long tail keeps passwords for the rest of the decade; a password manager becomes the thing that holds both for you and quietly switches between them per site.