Are Passkeys Safer?
The Honest Answer, Including the Caveats
Yes. A passkey removes the three ways credentials are actually stolen - phishing, data breaches and reuse - and does so structurally rather than by asking users to be careful.
But "safer" is not unconditional. A passkey is only as strong as the place its private key lives, and for most accounts the weakest point is no longer the passkey - it's the recovery path behind it.
The Short Answer
On the attacks that actually happen, passkeys are not marginally better than passwords. They eliminate entire categories.
- Phishing stops working, because the credential refuses to respond to any domain but its own.
- Data breaches stop mattering, because the service only ever held a public key.
- Reuse becomes impossible, because a separate key pair is generated for every service.
- Guessing and brute force stop being relevant, because there is nothing human-chosen to guess.
Those four cover the leading ways accounts are compromised - see Common Password Attacks. Passkeys don't make those attacks harder. They remove the thing being attacked.
That is a rare kind of security improvement, and it deserves stating plainly before the caveats.
Can Passkeys Be Hacked?
Not in the sense people usually mean. There is no known way to derive a private key from a public one, no password to crack, and nothing transmitted during sign-in that would be useful if intercepted.
What can go wrong is different in nature, and there are four honest answers.
A compromised device. If malware controls the computer you're signing in from, it can act inside your session once you've authenticated. A passkey proves you were present; it doesn't police what happens afterwards. This is true of every authentication method ever devised.
Account recovery. Nearly every service keeps a fallback - an email link, a password, a support call. That fallback is a legitimate route into your account, and attackers know it. An account with a strong passkey and a weak recovery mailbox is protected by the mailbox.
Social engineering. Nobody needs your private key if they can persuade you to register theirs. A confident phone call asking you to "re-register your security key" attacks the person, not the protocol.
The rest of your accounts. Passkey support is still partial, so most of your logins remain passwords for now. Your overall exposure is set by your weakest account, not your best one.
None of these are passkey flaws. Three of them are reasons to keep the rest of your security tidy, and one of them - recovery - is the subject of the next section.
The Question That Actually Decides It
If passkeys close the traditional attacks, the honest follow-up is: where does the risk go instead?
It moves to two places. Where the private key is stored, and how you get back in if you lose it.
Where the key lives
This is the distinction that decides how much of the protection above you actually receive, and most articles skip it.
Synced passkeys live in a software vault - iCloud Keychain, Google Password Manager, a password manager - and are copied between your devices through that provider's cloud. Convenient, and a genuine improvement over passwords. But the private key exists in several places at once, and the whole collection is guarded by your account with that provider. That account is typically protected by a password, which puts one more link in a chain you were trying to shorten. Compromise it and you compromise every passkey inside.
Hardware-bound passkeys are generated inside a secure element and physically cannot leave it. There is no cloud copy, no provider account in the chain, and no export path even for someone holding the device. Seedkeeper PRO works this way, on a chip certified EAL6+ and FIDO2 Level 1 by the FIDO Alliance, with firmware published under AGPLv3 so the implementation can be audited rather than trusted.
Both are safer than a password. They are not equally safe. The difference isn't in the cryptography, which is identical - it's in how many places your key exists and who else stands in the chain. See Not All Passkeys Are Stored the Same Way for the full comparison.
How you get back in
This is where most real-world passkey risk now sits, and it's the part people skip.
A hardware-bound passkey cannot be restored from a backup - the key that can't be extracted by an attacker also can't be extracted by you. Lose the only device holding it, with nothing else registered, and you fall back on the service's recovery process. Which is often an email link. Which is often protected by a password.
The fix is unglamorous and takes about ten minutes: register a second device on the accounts that matter, before you need it. Do that and the trade-off disappears - hardware-grade protection with a spare in a drawer. Skip it and you've fitted a strong lock to a door with a weak side entrance. See Passkey Backup Strategy and Passkey Recovery Strategy.
What If Someone Steals the Device?
A reasonable worry, and the answer is the reason hardware authenticators require a PIN.
Possession alone is not enough. A stolen Seedkeeper PRO still needs the FIDO PIN, which is verified inside the secure element rather than by an app, and which locks the device after repeated failures. There is no way to brute-force it from outside and no way to read the keys off the chip.
This is the classic pairing doing its job: something you have, something you know - the two categories set out in Authentication Factors Explained. A thief has one half. Meanwhile, you use your second registered device to remove the lost one from your accounts - which is the whole reason for registering it in advance.
Safer for Whom?
One dimension the comparison tables miss entirely.
A password's security depends almost completely on the person using it. Did they choose something long? Did they reuse it? Did they spot the fake page at 7am on a Monday? Good habits produce good outcomes, and most people, most of the time, don't have good habits - not through carelessness, but because the system asks something unreasonable of them.
A passkey's security doesn't vary that way. The distracted user and the meticulous one receive the same cryptography, the same domain binding, the same immunity to reuse. There is no way to configure it badly, no shortcut available when you're in a hurry, and no discipline to sustain over a decade.
Passkeys are safest for exactly the people passwords fail most. That is arguably the most underrated point in the entire comparison, and the strongest argument for deploying them across an organisation rather than training people harder.
It is also why regulators have started pointing the same way. The EU's NIS2 directive lists multi-factor authentication among required risk-management measures in Article 21(2)(j), and current guidance increasingly reads "appropriate" as meaning phishing-resistant on privileged accounts and remote access - a bar one-time codes do not clear. See Passkeys and NIS2.
So, Are Passkeys Safer? The Verdict
Yes - with one condition attached.
A passkey is safer than a password in every situation where credentials are actually stolen, and it achieves this without depending on your vigilance. For hardware-bound passkeys on a certified secure element, it is the strongest authentication generally available to individuals and organisations today.
The condition is that you plan your recovery. Not because passkeys are fragile - because they're strong enough that the way back in becomes the weakest link. And a weak link is a weak link wherever it sits.
Ranked plainly, from weakest to strongest:
- A reused password
- A long, unique, generated password
- A password plus a one-time code - see Passkey vs OTP
- A synced passkey in a cloud vault
- A hardware-bound passkey on a certified secure element, with a second device registered
Most people are somewhere in the first three. Moving up two places is worth an afternoon.
Everything on one device
Seedkeeper PRO stores your passwords, your TOTP codes and your passkeys on a single EAL6+ secure element, FIDO2 Level 1 certified. No cloud, no account, no vendor lock-in.
Get your Seedkeeper
FAQ
Are passkeys safer than passwords?
Yes. They eliminate phishing, credential stuffing, reuse and brute force as attack categories rather than making them harder, and their strength doesn't depend on the choices of the person using them. See Passkey vs Password.
Can a passkey be stolen remotely?
Not a hardware-bound one. The private key never leaves the secure element, so there is nothing on your phone or computer for malware to copy. Synced passkeys are exposed to whatever compromises the cloud account holding them.
What happens if someone steals my Seedkeeper PRO?
They still need your FIDO PIN, which is checked inside the secure element and locks out after repeated failures. The device alone is not enough. See What If Someone Steals the Device? above.
Are synced passkeys bad?
No - they're far safer than passwords and they're what most people will use. They simply concentrate every credential in one cloud account, whereas hardware-bound passkeys don't exist anywhere but the device. Choose according to what the account is worth losing.
What is the biggest risk with passkeys?
Losing every registered device with no spare, and having to fall back on a recovery path that may be weaker than the passkey itself. It's a planning problem with a ten-minute solution, not a flaw in the technology.
If passkeys are so good, why does my account still have a password?
Because services keep it as a recovery route, and most don't allow removing it. This is the caveat above in practice: your account is protected by the strongest available way in, not the one you prefer to use.
Is it worth switching if I already use a password manager and 2FA?
Yes, on the accounts that matter. A manager fixes reuse and strength, and 2FA fixes leaked passwords, but neither stops real-time phishing. Only domain binding does.
Are passkeys safe enough for a business?
They're increasingly the reference standard for it, precisely because they don't depend on staff judgement under pressure. Organisations can also require hardware-bound credentials and exclude personal cloud vaults - see Configure Passkeys in Microsoft Entra ID and Security and Compliance for Organizations.
Are passkeys enough to satisfy NIS2?
NIS2 does not name any technology. Article 21(2)(j) requires multi-factor or continuous authentication "where appropriate", and authentication is only one of ten measure categories in that article - so passkeys address part of the obligation, not all of it. Where they help most is on privileged accounts and remote access, and hardware-bound credentials additionally let you evidence which devices were used. Your national transposition and sector obligations govern what applies to you.