Passkeys Improve Login Security but Bring Device and Lock-In Risks, TechRadar Says

Passkeys have been marketed as a comprehensive answer to online security problems, and Apple, Google and Microsoft have rolled them out, with many websites now offering them as a login option. TechRadar examined whether they deliver on that promise and what users may give up in exchange.

The article said passwords are failing because they are easy to forget, especially when users create unique ones for every service. Large data breaches can leave credentials circulating on dark web marketplaces, and password reuse means one compromised site can expose email, banking and social media accounts. Password managers help, TechRadar reported, but they do not protect against phishing because users can still be tricked into typing credentials into a fake login page.

Passkeys instead use cryptographic keys. A public key is stored on the website's servers, while a private key remains on the user's device. During login, the device proves the user's identity mathematically without transmitting a password, so there is no password for a remote attacker to steal, according to the article.

Most passkeys require authentication through a fingerprint, facial scan or PIN on a phone or computer. TechRadar said biometric data does not leave the device. The scan unlocks a secure chip that stores the private key, and companies such as Apple, Google and Microsoft do not see the user's biometric template; they manage the encrypted container holding the passkeys.

The risks are different from those associated with passwords. TechRadar said a thief who has a user's unlocked device and knows its screen lock PIN could potentially access passkey-secured accounts, although most devices require re-authentication for each login attempt. Another concern is ecosystem lock-in: passkeys are often tied closely to platforms such as Apple iCloud Keychain and Google Password Manager. Syncing works smoothly within one ecosystem, but moving between iPhone and Android can be difficult, and users may be locked out of accounts unless they have exported their passkeys beforehand.

TechRadar concluded that passkeys are stronger than passwords, particularly against remote attackers and phishing attempts, because the cryptographic approach eliminates entire categories of attacks. Still, they introduce new considerations around physical device security and platform dependency. The article advised users to treat passkeys as an upgrade rather than a magic wand and to combine them with habits such as keeping devices updated and using screen locks.