Stay on reused passwords and one leaked database or one fake login page can hand someone your account. Passkeys close both gaps: the site keeps only a public key, and a passkey won't work on a lookalike site. Switch to passkeys wherever a service offers them, and keep long, unique passwords in a password manager everywhere else.
Anyone running their own logins, or a small team deciding whether to move everyone's sign-ins across, will find the two methods set out below in no particular order. Everything here comes from what Apple, Google, the UK National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA) say on their own pages. Neither gets a score; you get the differences, what each still needs, and a plan.
How each one signs you in
A password is a shared secret. You know it, the site keeps a record it can check against, and you prove who you are by typing it in. The NCSC says passwords remain the default sign-in method for a huge range of services, and it points out why system owners like them: they need no special hardware. Any keyboard on any device will do.
A passkey works differently. Apple describes passkeys as a replacement for passwords, built for passwordless sign-in, and says they use the WebAuthn standard, which relies on public key cryptography. That means a pair of keys rather than one secret. Google says the site stores only a public key instead of a password, while the private half stays with you, and you never have to type or remember it.
So the real difference isn't convenience, although that's what most sign-up prompts lead with. It's where the secret lives. With a password, both sides hold something worth stealing. With a passkey, only you do, and that one change explains almost everything else on this page.
Passkey upsides and downsides
The upsides come straight from the two companies pushing passkeys hardest. Apple says passkeys are resistant to phishing and always strong. You can't create a weak passkey, because you don't make it up at all; there's nothing to keep memorable and nothing to reuse on another site.
Google adds the phishing detail that matters most to a busy business owner. A passkey works only on the website or app it was registered with, which blocks fake-site sign-ins. A convincing copy of your bank's or your email provider's login page gets nothing from it. With a password, that same fake page is exactly where people get caught, because a password works wherever it's typed.
The downsides are about reach rather than safety. The NCSC is clear that passwords are still the default for a huge range of services, so a passkey only helps on the services that have added support for it. Until every account you use offers one, you'll be running both side by side. That's the normal state of things today, not a sign you've set something up wrongly.
There's a habit to unlearn as well. People who've spent years resetting forgotten passwords tend to expect the same routine with a passkey, and there isn't one to follow in the same way. Give yourself and your team a little time to get used to signing in without typing anything.
Password strengths and weak spots
A password's biggest strength is that it works everywhere. No device needs to support a standard, nothing needs pairing, and anyone can sign in from a borrowed laptop. The NCSC names that lack of special hardware as the reason system owners like passwords, and it's a fair point for a team with older kit or shared machines.
The weak spots are the person and the server. CISA compares an easy-to-guess password to leaving the key in the lock, which is a neat way of saying a password is only as strong as the human who made it up. And because the site holds something it can check against, a breach on its side is worth more to an attacker than a breach of a site that holds only public keys. That's the comparison Google draws when it explains why passkeys make a server breach worth less.
None of that makes passwords useless. The NCSC treats passwords as one part of a wider access control approach, not the whole defence, and CISA's advice for anyone staying on them is simple: make them long, random and unique, and keep them in a password manager. Follow that and a password stops being the easy target CISA describes.
No shared secret, nothing to leak
Here's the detail most comparisons skip. Apple's own page says passkeys are designed so that there are no shared secrets. The server holds only a public key, which can't be used to sign in on its own. If that company is breached, there's no password list to leak, no reused password for criminals to try on your other accounts, and nothing for you to rush to change.
That's the one thing a password can never offer, however long and random you make it. A perfect password still has to be checked by the other company's server, so you're trusting their security as much as your own. With a passkey, your safety stops depending on whether every site you've ever signed up to looks after its database.
It's also why the usual advice after a breach, to change your password everywhere you reused it, simply doesn't apply to a passkey. There's nothing reusable to change, and nothing a criminal can carry from one site to the next.
Passkey and password, compared at a glance
The two sign-in methods are shown alphabetically, in no particular order, with a short line on each taken from the official pages.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
| Tool | How it works | Who it suits |
|---|---|---|
| Passkey | Passwordless sign-in, public key cryptography | Accounts on services that offer passkey sign-in |
| Password | Memorised secret, the long-time default | Every service, including those without passkey support |
Passkey
Best for: Passwordless sign-in where a service supports it; Apple describes passkeys as a replacement for passwords, built on the WebAuthn standard.
Password
Best for: Signing in anywhere at all, since the UK NCSC says passwords remain the default sign-in method for a huge range of services.
Where to switch first
Switch your most important accounts to passkeys as soon as each one offers them, starting with email, because whoever controls your inbox can usually reset almost everything else. Then work through banking, your website and your social accounts. Where a service still only takes a password, follow CISA's advice: long, random, unique, and stored in a password manager.
For a team, I'd go in the same order and make the password manager a rule rather than a suggestion, since it's what keeps the accounts without passkey support safe. My guide to the best password managers for small business covers that side. If you're adding a second step to logins that still use passwords, Authy vs Google Authenticator compares two authenticator apps, and if you'd like a first passkey to practise on, my walkthrough on the Instagram passkey is an easy place to try one.
Don't delete a password the day you add a passkey to that account. Keep it stored in the manager until you're sure every device you use can sign in the new way, then decide what to do with it.
Do you make passkey, password or sign-in security software? Tool makers can ask to be considered for a featured place on this list.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Is a passkey safer than a password?
On the points Apple and Google set out, yes: passkeys resist phishing, are always strong and leave no password on the server to leak. A long, random, unique password in a password manager is still a sound choice where passkeys aren't offered.
Can a passkey be phished?
Google says passkeys work only on the websites and apps they're registered with, so a fake login page can't use one. That's the reason Apple describes them as resistant to phishing.
Do I still need passwords if I use passkeys?
Yes, for now. The NCSC says passwords remain the default sign-in method for a huge range of services, so most people will keep both while support grows.
What happens if a site holding my passkey is hacked?
The site holds only a public key, so there's no password to leak or reuse elsewhere. Google describes this as making a server breach worth less to attackers.
What makes a strong password?
CISA advises passwords that are long, random and unique to each account, kept in a password manager. It compares an easy-to-guess password to leaving the key in the lock.
What standard do passkeys use?
Apple says passkeys are built on the WebAuthn standard, which uses public key cryptography rather than a secret shared with the site.
