A blog post titled “Passkeys are a trap. Do not use them” has been making the rounds this week, and the headline is doing exactly what headlines are supposed to do: starting an argument. The piece, attributed to a security-minded developer, argues that passkeys trade a familiar, portable credential for a system controlled by platform vendors, and that users who adopt them are quietly surrendering ownership of their own accounts. It’s a provocative claim, and like most provocative claims, it’s about a third right, a third overstated, and a third pointing at something the industry would rather not discuss.
Start with what passkeys actually are, because the term gets used loosely. A passkey is a cryptographic key pair tied to a device or a synced keychain. The private half never leaves your hardware, and the public half sits on the server. Logging in means proving you hold the private key, usually with a fingerprint, face scan, or PIN. There’s no shared secret to phish, no string to reuse across sites, and no password database for a company to leak. On paper, that’s a genuine step forward from a credential model that has been failing us for decades.
The criticism lands hardest on ecosystem control. When Apple, Google, and Microsoft sync your passkeys through their own keychains, the practical portability of those credentials depends on their cooperation. If you buy an iPhone today and a Windows laptop tomorrow, moving passkeys between them isn’t as simple as exporting a file. The FIDO Alliance has been working on cross-platform credential exchange, and some password managers now support passkeys directly, which helps. But the friction is real, and the argument that convenience has been purchased with a degree of platform dependency is not paranoia. It’s a legitimate design tradeoff that vendors have been slow to acknowledge.
Recovery is the other soft spot, and it’s the one that worries me more. Passwords are bad because people reuse them and phish them, but they have one underrated property: if you forget one, you can usually reset it through email or a support line. Lose every device holding your passkeys, and the recovery path runs through the same platform accounts you were trying to secure in the first place. That’s fine for most people most of the time, and catastrophic for the unlucky minority who get locked out of their Apple or Google account. Security researchers have been flagging this for a while, and the answers remain uneven.
Where the “trap” framing goes too far is the implication that passkeys are secretly worse than passwords. They aren’t. The phishing resistance alone is worth the tradeoff for the vast majority of accounts. The problem isn’t the technology; it’s the marketing. Passkeys have been sold as a finished solution when they’re really a transitional one, and users who discover the rough edges feel misled. That’s a trust problem, and trust is the only currency authentication has.
There’s a broader pattern here that should sound familiar. Every few years the industry anoints a successor to passwords, whether it’s biometrics, magic links, or hardware tokens, and every time the rollout stumbles on the same issues: recovery, interoperability, and the assumption that users will happily let a handful of companies become the gatekeepers to their digital lives. Passkeys are better than most of those attempts. They’re backed by real cryptographic standards, not just a vendor’s marketing department. But standards don’t solve governance, and governance is where this gets uncomfortable.
For now, the sensible position is neither evangelism nor boycott. Use passkeys where they’re offered, especially on high-value accounts like email and banking. Keep a password manager as a fallback and store recovery codes somewhere that isn’t your phone. If you’re deploying passkeys inside an organization, plan for the employee who loses a device, because that scenario will happen and your help desk needs an answer that isn’t “buy a new iPhone.”
The viral post will fade, as these things do. What should linger is the underlying question it raises: when authentication becomes infrastructure, who owns the keys? Right now the honest answer is the platforms, and until that changes, a little skepticism is healthy. Not because passkeys are a trap, but because the companies pushing them have earned a certain amount of scrutiny.