The Rise of Passkeys: Is Your Password Manager Now Considered Obsolete?

Recently, you may have encountered prompts from major platforms like Google, Apple, or Microsoft urging you to establish or save a passkey. With a simple tap and verification via your face or PIN, you can sign in without any typing involved. This raises an important question: what does this mean for your password manager?

Understanding the Distinction Between Passwords and Passkeys

To fully grasp the evolution of password managers, it’s crucial to recognize the inherent vulnerability in traditional passwords: they are essentially a shared secret.

Password managers do an excellent job of minimizing credential reuse while generating complex, hard-to-guess passwords. However, they still cannot protect you from inadvertently entering credentials on a counterfeit login page. Phishing scams thrive on the fact that fraudulent websites can closely mimic legitimate ones. Once you input your username and highly secure password, attackers are quick to seize that shared secret.

Passkeys effectively eliminate this threat by utilizing domain-specific security through public-key cryptography.

When you set up a passkey, your device creates a key pair. The Private Key remains securely stored on your device, while the Public Key is shared with the respective website.

During a login attempt, the website presents a unique mathematical challenge to your device. After verifying your identity through FaceID or a fingerprint, the device signs the challenge using the Private Key, which the website confirms using the Public Key. This way, no actual secret traverses the network, making it impossible for phishing sites to capture anything. Even in the event of a database breach, hackers would only acquire the Public Key, which is of no use without access to your device’s Private Key.

Areas Where Password Managers Remain Indispensable

Despite the strong security advantages offered by passkeys, password managers have not become obsolete. They continue to play an essential role in managing our broader digital presence for several compelling reasons.

Inaccessible Legacy Sites

As tech giants embrace passkeys, many existing internet platforms operate on outdated systems. Services such as your local utility provider, dental office portals, and various small forums are unlikely to transition their security frameworks anytime soon. Therefore, traditional passwords will continue to be a necessity. Here, password managers provide the best defense against using identical passwords across different accounts.

Comprehensive Storage for Secure Notes and Payment Information

While passkeys focus solely on the login process, password managers serve as fortified vaults for managing your digital life. They securely store valuable information, including Wi-Fi passwords, credit card details, software licenses, and scanned identification. Until a universal standard for digital wallets emerges, password managers remain the most efficient method for managing sensitive information.

Passkeys are essentially personal, linked to individual devices, which complicates sharing among groups. Password managers, in contrast, excel in this area, allowing families and teams to share specific credentials securely across devices without disclosing master passwords or requiring physical access to a device.

Major Password Managers are Embracing Passkey Integration

Rather than opposing passkeys, the password management industry is adapting to incorporate them. Many prominent third-party managers now allow users to store passkeys alongside traditional passwords.

When a site prompts you to create a passkey, your password manager captures the request and saves the associated cryptographic key in your vault. This method allows for cross-platform synchronization. For example, while using Apple’s iCloud Keychain may require your iPhone to scan a QR code for logging in on Windows, third-party managers eliminate such compatibility issues, enabling seamless integration via browser extensions on platforms including Windows, Mac, iPhone, and Android.

Apple and Google’s Edge Over Third-Party Solutions

Although third-party managers provide superior cross-platform compatibility, Apple’s iCloud Keychain and Google Password Manager deliver unmatched convenience. Operating at the core operating system level means no installations or management are necessary. These tools are free, easy to set up, and seamlessly integrated with biometric security features you already use daily.

Navigating the Apple or Google Ecosystem Exclusively

If you are part of the Apple or Google ecosystem, such as owning an iPhone and Mac or using an Android device with a Chromebook, you’re in an ideal position to largely transition to a passwordless experience. Utilize iCloud Keychain or Google Password Manager to manage passkey generation, storage, and synchronization with ease.

Setting Up Passkeys on Google: Access your Google account and search for Passkeys and security keys.

Setting Up Passkeys on Apple: Navigate to Settings → search for Passwords & Keychain.

For Those Using Multiple Platforms or Managing Family Accounts

If you’re using an iPhone but primarily work on a Windows PC, employing a third-party password manager is advisable. You can easily create passkeys on your mobile device and access them on your Windows laptop without complications. Moreover, sharing subscription or utility credentials with family members becomes straightforward. Tools such as 1Password Families and Bitwarden are well-suited for this scenario.

In High-Security Work Environments

In scenarios involving small business operations or IT management, the free and personal tiers of most password managers may fall short. In such cases, administrative features like activity logs, permissions, and centralized account recovery are essential. Solutions like NordPass Business enable you to implement strict security policies and immediately revoke access to shared vaults if an employee departs.

Transitioning to Passkeys Without Abandoning Established Practices

You don’t have to overhaul your entire digital experience to incorporate passkeys right away. A hybrid approach is often the most practical strategy. Begin with accounts that are critical to your operations, which can include your main email, banking apps, and primary social media accounts.

Configuring Your Password Manager to Act as a Passkey Vault

Before generating any passkeys, ensure your third-party password manager is set up to intercept and store them efficiently.

For instance, if you’re using Bitwarden on an iPhone, navigate to Settings → Passwords & Accounts → Autofill Passwords to select Bitwarden. On Android, go to Settings → Passwords & Autofill and designate Bitwarden as your default provider.

Creating Passkeys on Supported Sites

Once your password manager is properly configured, log into your priority accounts (such as Google or Amazon), and go to the Account Settings → Security menu. Choose the Add a passkey option and click Create.

Your password manager will prompt you to save the cryptographic key in your vault, allowing for password-free login on subsequent visits. Repeat this process for each of your prioritized accounts.

Reviewing Your Remaining Passwords

For the numerous accounts that still depend on passwords, use this transitional phase to clean up your vault.

Begin by scanning for reused passwords and updating them promptly.
Utilize your password manager’s built-in generator to replace weak passwords with robust strings (20 characters or more).
Activate Two-Factor Authentication (2FA) wherever feasible. Most password managers can now secure and auto-fill the six-digit TOTP (Time-based One-Time Password) codes for heightened security.

By employing passkeys on sites that support them, you significantly reduce phishing threats, while maintaining a reputable password manager as your digital vault for all other credentials. This robust strategy offers both mathematical security safeguards and user-friendly accessibility.

If your password manager fails to save a passkey, consider checking for any conflicts associated with browser extensions.

Source & Images

The Rise of Passkeys: Is Your Password Manager Now Considered Obsolete?

Understanding the Distinction Between Passwords and Passkeys