For years the advice was consistent: use a password manager, give every account its own long password, switch on two-factor authentication. Passkeys arrived promising to remove the password altogether, and the big platforms have pushed them hard. So which one should guard your email, your bank, and your company's payroll system in 2026? The useful answer is that they defend against different attacks, and the strongest setup uses both. Knowing where each one breaks is what keeps you out of trouble.

Two very different kinds of secret

What a password manager actually does

A password manager is a vault. You remember one strong master password, or a short PIN plus a fingerprint, and the vault generates and stores long random passwords for everything else. Its real strength is scale: it kills password reuse across hundreds of sites, refuses to autofill on a domain that doesn't match what you saved, and gives you one place to keep recovery codes and one-time-passcode seeds.

But the password itself still exists. It travels to the server, it can be typed into a fake page, it can be captured by malware hooked into your browser, and it can be lifted from a company that gets breached. A manager shrinks the damage from weak and repeated passwords. It doesn't remove the shared secret.

What a passkey actually does

A passkey is a key pair, not a string. The private half stays on your device or in your platform keychain — iCloud Keychain, Google Password Manager, Windows Hello, or a password manager that supports passkeys. The public half sits with the website. When you sign in, your device signs a challenge that includes the site's origin. Nothing reusable crosses the network, so there is no password for a phishing page to harvest, and a stolen user database doesn't hand an attacker a working credential.

That origin binding is the part people underestimate. A convincing clone of your bank's login page on a lookalike domain cannot complete a passkey ceremony at all. The browser simply won't offer the credential.

Phishing is where passkeys pull ahead

Consider the worst case for a password manager: you're tired, a page looks right, and you type your master password into it. Everything you own is now in someone else's hands, including the vault export. Passkeys don't allow that failure. There is no secret to type, and an attacker relaying your login through a proxy still can't produce a signature for the wrong domain.

Passkeys are not magic, though. They don't stop malware running on an already-unlocked device, they don't stop session cookies being stolen after login, and they don't stop a malicious browser extension from tampering with what you see. Most importantly, they don't stop an attacker from attacking the recovery path instead of the login. Anyone who tells you passkeys make an account unhackable is selling something.

Where password managers still win

• Coverage. Passkeys are spreading, but plenty of systems still take a username and password: internal tools, older portals, point-of-sale terminals, that one supplier site nobody has touched since 2019. A vault works everywhere today.
• Sharing. Passkeys are built for one person and one device. Shared mailboxes, joint streaming accounts, and team service accounts need a shared credential with an audit trail, which is squarely password-manager territory.
• Ownership and portability. You can export a vault and move it between providers. Passkeys are often tied to whichever keychain created them, which is improving but still a real constraint.
• Housekeeping. Weak-password reports, reuse detection, breach alerts, and rotation reminders are features passkeys don't need and don't offer.
• Everything else. Licence keys, Wi-Fi passwords, secure notes, passport scans. A vault holds more than logins.

There's also a quiet advantage: because passkeys can be stored inside a password manager, you don't have to choose one ecosystem. The vault becomes the sync layer, and you keep the ability to see what you own.

Recovery is the soft spot for both

Attackers go after the reset flow because it's usually weaker than the front door. If your only passkey lives on a phone that gets dropped in a lake, you're dependent on the provider's account recovery, which often falls back to email or SMS. If your vault's master password is forgotten and the recovery kit is in a drawer you can't find, the vault is a brick.

Three habits fix most of this. Register a second passkey on a different device or a hardware security key for anything critical. Print or write recovery codes and store them offline, somewhere a burglar won't casually find. Keep your recovery email in a separate account you can genuinely get into, ideally with its own passkey. If a financial institution's recovery process requires a phone call or branch visit, read that policy before you need it — and check with the institution directly about how they handle lost devices.

Business accounts: what to roll out, and in what order

1. Start with administrators. Phishing-resistant sign-in for identity provider admins, email admins, finance approvers, and anyone with production access.
2. Then general staff. Turn on passkeys or hardware keys where the identity provider supports them, and keep passwords plus strong second factors where it doesn't.
3. Handle shared credentials separately. Move them into a password manager with individual logins, role-based sharing, and logging. Never let five people share one passkey on one phone.
4. Deal with machine accounts. Service accounts, API keys, and CI/CD secrets belong in a secrets vault with rotation, not in a spreadsheet or a chat message.
5. Plan for the outage. Two sealed break-glass paths, documented, stored offline, and tested before you need them at 2 a.m.

Expect friction during the transition. Helpdesks get more reset calls in the first month, not fewer, because people lose devices and forget which method they enrolled. Budget for that instead of being surprised by it.

The setup that holds up

If you want the short version, do this in order:

• Turn on passkeys for your primary email account first. It's the reset key for everything else.
• Add a passkey to your password manager account too, and keep the master password written down somewhere physically secure.
• Leave the manager doing what it's good at: unique passwords for the long tail, shared logins at work, and a home for codes and notes.
• Register a second passkey or a hardware key on your five most valuable accounts.
• Once a quarter, sign in to one critical account from a device that isn't yours, using only the recovery path. Finding the gap on a Tuesday afternoon is far better than finding it during an incident.

Neither method is the safe choice on its own. Passkeys remove the phishable secret; password managers remove the reused, guessable one. Run both, and spend your worry on recovery, which is where accounts actually get lost.

Photo: EsaRiutta / Pixabay