Look, I’ll be honest — a couple of days ago I had no real idea what passkeys were.

Look, I'll be honest — a couple of days ago I had no real idea what passkeys were.

Like most people, I'd seen bits on YouTube, read the odd article, and came away more confused than informed. Some of it made them sound like the second coming. Other bits made it sound like you could lock yourself out of your entire digital life with one wrong move.

So I did what I usually do — dug into it properly and worked it through step by step.

Now I understand it.

And the truth, as usual, sits in the middle.

⸻

First thing to get straight:

Passkeys are good. Very good.

They're far more secure than passwords. No typing, no phishing, no "click this link and enter your details" nonsense. You just use your device — Face ID, fingerprint, whatever — and you're in.

What that actually means is this:

A passkey isn't something you type. It's a secure digital key created for that account and stored on your device (or in your device's password system like Apple Passwords). When you log in, your device proves it has that key — using Face ID, fingerprint, or your device unlock — and lets you in.

That's why they're so secure.

That's the upside.

But it also explains the catch:

If you lose access to where that key is stored, you can lose access to the account.

So one golden rule alongside using passkeys:

Always keep a fallback.

Make sure your recovery email, phone number, or backup login method is still active — especially for important accounts.

⸻

So, now the bit nobody explains clearly:

Passkeys have to live somewhere.

They're not just floating around in the ether.

On an iPhone or Mac, they sit in Apple Passwords (iCloud Keychain).

On Android, they sit in Google's system.

That matters. Seriously.

Because if you start creating passkeys all over the place without knowing where they're going, you can make life harder for yourself later — especially if you ever change devices or ecosystems.

⸻

So here's the practical way to handle it.

Don't go mad.

Don't accept every "create a passkey" prompt that pops up.

Be selective.

I fell into that myself. A few prompts came up, I thought "that sounds like a good idea," and clicked yes — without really knowing what I was doing. I've now got about eleven passkeys sitting there, and if I'm honest, only eight of them are actually important.

The rest? I didn't need them.

At the moment, I don't need any more.

⸻

Use passkeys for important accounts only:

• Your main email

• Apple / Google account

• Banking (if your bank supports it properly)

• PayPal

• Amazon

That's your core digital life.

That's where they earn their keep.

⸻

Everything else?

Leave it on passwords for now.

There's no prize for having 50 passkeys scattered across random shopping sites and apps you barely use.

⸻

Next key point:

Keep them in one system.

If you're using Apple devices, save them in Apple Passwords.

Don't start mixing:

• some in Chrome

• some on a random device

• some somewhere else

That's how people get into trouble.

⸻

And this is the bit that worried me at first — quite rightly:

"What happens if I switch from Apple to Android?"

Answer: nothing… if you prepare.

But if you just jump ship without thinking, then yes — you could find yourself locked out of accounts that only have Apple-based passkeys.

So if you ever do switch:

• go through your important accounts first

• make sure you've got another login method

• or set up new passkeys on the new system before you leave

It's an admin job, not a disaster.

⸻

Final point — and this surprised me:

On the iPhone, you can actually see your passkeys.

They're sitting there in the Passwords app.

So you're not flying blind.

⸻

So where does that leave it?

Simple.

Passkeys really are the future — but we're in the early days of how people use them.

Used properly:

• they make life easier

• and much more secure

Used blindly:

• they can create confusion

⸻

My approach now?

Use them where they matter. Ignore them where they don't. Keep them in one place.

That's it.

— No drama. No lockouts. No nonsense.

⸻

First published on Linkedin by John Covington.