Passkeys on a Mac, and when they replace a password
· 5 min read
A passkey is a cryptographic key pair replacing a password. The site keeps the public half; your device keeps the private half and never sends it anywhere. Signing in means your device proving it holds the key, authorised by Touch ID or your device passcode.
The consequences are worth understanding, because two of them solve problems nothing else has.
Why they matter
They cannot be phished. A passkey is bound to the domain it was created for. A lookalike site cannot use it, because the browser will not offer it. This removes the single most successful attack on ordinary people. Phishing that targets Mac users covers what that attack looks like.
They cannot be reused. Each is unique to its site by construction, so one compromised service cannot expose others.
There is nothing to steal from the site. A breach exposes public keys, which are useless on their own.
No typing. Touch ID and you are in.
That first point is the one that matters most. Phishing works on careful people because the pressure is designed to bypass care. A passkey makes the question irrelevant.
Using them on a Mac
Passkeys are stored in iCloud Keychain and sync across your Apple devices automatically.
Creating one: on a site that supports them, look for “create a passkey” or “sign in without a password” in account settings. Confirm with Touch ID and it is done.
Signing in: the browser offers the passkey; you authorise with Touch ID or your password.
On a non-Apple device: the site shows a QR code, you scan it with your iPhone, and the phone authorises over a local Bluetooth connection. The passkey never leaves your device.
Managing them: System Settings, Passwords. Passkeys appear alongside saved passwords and can be deleted there.
Where they fall short
Not every site supports them. Adoption is growing steadily and most of the internet still wants a password.
Recovery is tied to your account. Passkeys sync through iCloud Keychain, so losing access to your Apple Account means losing them. This makes the account recovery path more important than ever. Two-factor authentication done properly covers setting that up, and it is genuinely the prerequisite.
Sharing is awkward. Passwords can be shared with a partner easily; passkeys are more constrained, though shared groups in the Passwords app now cover common cases.
Ecosystem friction. Using a passkey on someone else’s Windows machine works via the QR flow and is more fiddly than typing a password.
Some sites keep the password anyway. A passkey that sits alongside a still-valid password does not remove the phishing risk, because the password is still there to be stolen. That is worth knowing: the benefit is only complete when the password is removed or the account requires the passkey.
Should you use them?
Yes, where offered, for accounts that matter. There is no realistic downside and the phishing protection is genuine.
Two things to do first:
Secure your Apple Account properly, since it is now the key to your keys. A second trusted phone number and a recovery contact, at minimum.
Keep a password manager for everything that does not support passkeys, which is still most things. Passwords in Safari, and moving to a dedicated manager covers the options.
Passkeys and password managers
Most password managers now store passkeys too, which means they are not tied to Apple’s ecosystem and can be used on Windows and Android without the QR dance.
If you already use a password manager and work across platforms, storing passkeys there is usually the better arrangement. If you are entirely on Apple devices, iCloud Keychain is simpler.
Questions
What if I lose all my devices? Passkeys sync through iCloud Keychain, so a new device signed in to your Apple Account gets them back. This is why the account recovery path matters so much.
Can someone steal a passkey? Not from the site, and not in transit. They would need your unlocked device or your Apple Account credentials plus your second factor.
Do I still need two-factor? A passkey is inherently multi-factor: the device plus your biometric or passcode. Keep two-factor on accounts still using passwords.
Are they safe if my Mac is stolen? Using them requires Touch ID or your password, so a locked Mac does not give them up. With FileVault on, the stored keys are encrypted at rest. FileVault covers that.