The biggest change
Passkeys are the biggest change to logging in since the password itself — and unusually for security news, the change is good. Instead of a secret you type (and can reuse, forget, or hand to a fake site), a passkey is a cryptographic key pair: the private half never leaves your device, and the site only ever sees a proof, never the secret. There's nothing to phish and nothing to steal in a breach.
So: are they safe? Genuinely, yes — safer than passwords in every way that gets accounts hacked. The more useful question is what they replace, and what they leave untouched.
The upgrade
Why they're a real upgrade
Three of the ways passwords get accounts hacked simply don't exist for a passkey.
The secret is never typed or sent, so a fake login page has nothing to capture.
Each passkey is unique to one site by design — no shared password to leak across accounts.
A fingerprint or face check on your device stands in for typing anything at all.
The limit
The one thing they don't solve
A passkey is a better front door — but it's not the house. It gets you into an account beautifully, yet says nothing about the identity you re-enter to open accounts in the first place: your name, address, date of birth, IDs — the eleven facts you re-type into every signup form. Passkeys replace the password step; they don't gather your identity, hold your documents, or fill the form.
The login: no more phishing, reuse, or a typed secret to steal. Adopt them wherever you can.
Your identity and documents, recovery for a lost device, and the passwords you'll still hold while support catches up.
There's also the recovery question: because most passkeys sync through your Apple, Google, or Microsoft account, that platform login becomes the single thing you must protect — and be able to get back into — above all else. Worth keeping a key the provider itself can't read; that's what zero-knowledge means, and why browser-stored credentials aren't the whole answer.
Passkeys open the door. We hold what's inside.
Simply Once keeps your identity, documents, and logins — passkeys and passwords alike — in one zero-knowledge vault, ready to fill any form.
Part of the guide: How to protect your personal data online →