Passkeys vs Password: Is the Password Era Ending in 2026?
In 2026, when you try logging into iCloud or Google account from a new device, you'll most likely be asked to use a "passkey" instead of a password. Apple has officially defaulted to passkeys for Apple ID since iOS 17. Google says over 800 million passkeys have been created by users. Microsoft Account also has full support.
But the question is: is this just a forced marketing trend, or is passkey actually better? I've been using passkeys for personal accounts for the past year. Here's the honest review.
What Passkeys Actually Are
Passkey is the implementation of FIDO2 + WebAuthn standards, wrapped in friendlier UX. Technically, a passkey is a pair of cryptographic keys:
- Private key stored on your device (phone, laptop), protected by biometric (Face ID, fingerprint) or device PIN.
- Public key sent to the server when you create an account. The server stores this.
When you log in, the server sends a random "challenge". Your device signs the challenge with the private key, sends the signature back. Server verifies using the public key. Done. No password is sent, no secrets that can be leaked.
The key point: private key never leaves your device. Different from passwords which you type and send to the server every time.
Why Passkeys Are Genuinely More Secure
After a year of use, here are concrete observations on why passkeys are better:
1. Phishing-Resistant
Classic phishing scenario: you get an email "your account has issues", click link to "google.com" but it's actually gooogle.com (3 o's). You enter password, immediately compromised.
With passkey, this can't happen. Browser checks the domain. If the URL bar domain isn't real google.com, the browser will NOT offer the option to log in with Google passkey. You can't even "mistype password to fake website" because there's no password to type.
I've tested it myself in a phishing simulation setup. The phishing email successfully bypassed spam filter, the link site copy-pasted exactly like Google login page, but when clicking "use passkey", the browser shows no option whatsoever. Phishing fails by design.
2. Database Breaches Become Less Catastrophic
In 2024 LastPass got breached. In 2025 there were several major breaches of popular services. If password hashes are stolen, attackers can try cracking offline. Even bcrypt hashes can be brute-forced for weak passwords.
Passkey is different. The server only stores public keys. Public keys can't be reverse-engineered into private keys (basic asymmetric cryptography mathematics). A database breach of a passkey service nets attackers nothing useful. Public keys can't be used to log into any account.
3. Automatically Strong Credentials
How many users still use "password123" or their dog's name as password? A lot. How many reuse the same password across 5 services? Even more.
Passkey automatically generates 256-bit cryptographic keys. That's strength that can't be brute-forced within the universe's lifetime. Plus each account gets a unique passkey, so no credential stuffing works.
But There's Friction Not Yet Resolved
To give an honest review, passkeys also have pain points still annoying in 2026:
1. Cross-Device Login Still Cumbersome
I use an iPhone. When I'm signing into a new account on a Windows laptop, my iPhone passkey login requires QR code scan + Bluetooth proximity. The setup works, but it's clunky. 3 out of 10 times the QR doesn't match because Bluetooth is flaky.
If you're at a hotel, work laptop without Bluetooth, trying to log into a service that only supports passkey, that's a frustrating experience. Solution: store passkey in a password manager (1Password, Bitwarden) that syncs via cloud. But then we're back to "trust cloud provider" which passkey was supposed to avoid.
2. If You Lose Your Device, Recovery is Hard
Forgot password? Email reset. Lost passkey? Depends on the service.
Apple: if you still have another Apple device logged into Apple ID, you can transfer passkey via iCloud. But if you only have 1 device and it's lost, recovery can be a horror story with customer service.
Google: has recovery via "trusted device" or backup phone number. More flexible, but still 2-3 days process if fully locked out.
Many small services just give "fall back to email + OTP". The irony is needing OTP to recover passkey, when passkey was supposedly meant to replace OTP/SMS auth.
3. Not All Services Support It Yet
Realistic adoption in 2026:
- Google, Apple, Microsoft, Amazon: full support
- GitHub, GitLab: support
- Discord, X (Twitter): support but not default
- Indonesian banks: almost none support
- Local marketplaces (Shopee, Tokopedia): not full support yet
- Smaller SaaS: mixed, many still password-only
Realistically, you still need a password manager for some accounts, plus passkey for those that support it. This hybrid setup will continue for several years.
Position of OTP / SMS Verification in the Passkey Era
One interesting question: if passkey becomes mainstream, is OTP/SMS verification still needed?
Realistic answer: Yes, for specific use cases.
OTP / SMS still relevant for:
- Account creation: when a user first registers, the server needs to verify "this user has valid identity (phone number, email)" before allowing them to create a passkey. Phone verification is still common proof of identity.
- Recovery flow: when passkey is lost, many services fall back to OTP via SMS/email as recovery channel.
- Step-up authentication: for sensitive transactions (large transfers, email change), services sometimes ask for additional OTP even when you logged in with passkey. This is "defense in depth".
- Services that don't support passkey yet: marketplaces, banking, fintech still mostly use SMS OTP. Until they migrate, OTP is still needed.
From a developer perspective, common combination in 2026: passkey as primary auth, plus OTP/SMS for verification steps (registration, recovery). For testing registration or verification flows across multiple development accounts, tools like OTPZap can provide virtual numbers for quick OTP retrieval without using personal numbers.
When You Should Migrate to Passkey
Practical advice based on experience:
Migrate now for these accounts:
- Your primary email (Gmail, Outlook, iCloud Mail): high security, complicated recovery if lost. Worth extra protection.
- Cloud storage with important data (Google Drive, iCloud, Dropbox)
- Password manager itself (if you use one)
- Developer accounts (GitHub, GitLab) if you're a developer
Wait for:
- Services you rarely use. If passkey is lost and recovery is hard, better stick with password manager.
- Banking/fintech. If your bank supports passkey, fine. But many Indonesian banks still use SMS OTP. Wait until infrastructure matures.
- Accounts shared with others (family password sharing, etc). Passkey is hard to share securely.
Closing
Passkey is more secure than passwords, that's a fact. But the UX isn't perfect yet. If you prioritize maximum security, start migrating to passkey for important accounts. If you prefer convenience and multi-device flexibility, password manager + 2FA via authenticator app is still a valid alternative.
What's certain, the era of "user-memorized passwords" is indeed near its end. Whether it's passkey or password manager, humans shouldn't memorize 100 unique passwords. That's a software task, not a brain task.
Going forward, expect more services to migrate. In 3-5 years, we might see passwords as the exception, passkey as default. Right now we're in the messy but necessary transition phase.