Passwords have had a long career, and a handover meeting is overdue. The trick is to hand over without locking yourself out of your own email on a Sunday evening.
The short answer
How do you secure your accounts with passkeys and 2FA today? Use a passkey wherever a service offers one, keep a second sign-in route that you have tested, and store your recovery codes offline [1][4][9]. Start with your email account and with the account that holds your passkeys, because most other accounts can be reset from those two [9][10]. This guide is a migration plan, not a product test. We have not tested the menus of the services named here, so we describe the principles from standards and vendor documentation and say where sources differ.
How it works
- Decide where your passkeys live. A passkey is a pair of cryptographic keys. The service keeps the public key, your device or password manager keeps the private key, and the browser only releases it to the site it was created for [1][4]. The underlying browser standard, WebAuthn Level 3, became a W3C Recommendation on 25 Aug 2026 [3]. FIDO calls passkeys that sync through a cloud "synced passkeys" and passkeys that never leave one device "device-bound passkeys" [1]. That gives you three homes. The operating system: Apple states that passkeys sync through iCloud Keychain, which is end-to-end encrypted [11]; Google offers its own password manager [9][15]; on Windows a passkey can be saved locally with Windows Hello or in Microsoft Password Manager [15]. A password manager: 1Password, Proton Pass, Bitwarden and KeePassXC each document passkey storage [19][21][22][23]. A hardware security key: its passkeys are device-bound [1][4]. Our assessment: if your devices come from different makers, a manager that runs on all of them avoids lock-in. Stiftung Warentest makes the same point and adds that iCloud Keychain is not a full passkey store on every device and that Google's manager needs Chrome on a PC [9]. Mixing is fine. FIDO's own paper suggests synced passkeys for standard accounts and device-bound ones for accounts that need the most protection [2].
- Protect that home first. Whoever opens your passkey store opens your accounts. FIDO says passkey syncing is end-to-end encrypted and that providers have strong account protections [1]. Apple requires two-factor authentication on an Apple Account that uses iCloud Keychain [11]. Whichever home you choose, check three things: the account behind it has its own second factor, you know how that account is recovered, and the device unlock is hard to watch over your shoulder. Stiftung Warentest advises against a short PIN as the unlock because people can observe it, and suggests registering at least two fingerprints [9]. Google adds a warning: once a passkey exists, anyone who can unlock the device can reach the account, so create passkeys only on devices you own and never on shared ones [12].
- Compare your three tools. Passkeys, security-key passkeys and TOTP apps solve the same problem differently. TOTP (time-based one-time password, RFC 6238) computes a short code from a secret key and the current time, with a default step of 30 seconds [7]. You type that code into the page, and that is the weak spot: the BSI notes that TOTP does not protect against phishing that happens in real time, because an attacker's proxy can relay the code [5]. NIST states the same for any output you enter by hand [8]. The table below sets the three side by side.
- Pick the order of your accounts. Do the accounts in this order, because each step protects the next. First, your email account: the BSI names email and social media as accounts with far-reaching powers, and consumer advisers say to protect email especially, since resets arrive there [6][10]. Second, the account that syncs your passkeys (Apple Account, Google Account, Microsoft account or your manager's account), including its recovery route. Third, accounts that handle money or identity: payment services, shops, cloud storage. Stiftung Warentest notes that passkeys are still the exception for online banking, so keep the bank's own second factor there [9]. Fourth, everything else, one account each time you sign in. Stiftung Warentest puts the work for the most important accounts at about half an hour and one to two minutes per account [9].
- Keep a fallback on purpose. Most services keep the password as a second route. Google says that adding a passkey changes none of your existing sign-in or recovery factors, and that with 2-Step Verification on, signing in with a passkey skips the second step [12]. That is convenient and also a risk, because an attacker aims for the weakest route. The BSI warns that a one-step recovery can weaken a stronger method considerably and asks you to choose services with two-step recovery [5]. Our approach: keep the fallback until you have signed in with the passkey on a second device and tried the recovery route once. Then change the old password to a long random one from your manager and, as Stiftung Warentest suggests, consider switching the password off only after some weeks of smooth passkey use and with backups in place [9]. Where the service lets you, prefer an authenticator app over SMS codes. The BSI advises against receiving the SMS code on the same device that you sign in with, because the factors are no longer separate [6].
- Build a recovery plan in three layers. Layer one: synced passkeys. They survive the loss of one device because the provider restores them on a new one. Apple documents recovery through iCloud Keychain escrow, which needs your account password, a code sent by SMS and your device passcode, with ten attempts before the record is destroyed, plus optional account recovery contacts [11]. Layer two: a second device-bound key. Security keys cannot be copied, so you register each key separately with every service [4]. Yubico recommends a backup key, because resetting a key removes its PIN and all its passkeys [17]. A YubiKey locks its FIDO2 function after eight wrong PIN attempts [17]. Capacity is documented as 100 passkeys on firmware 5.7 and later [17][18]; Yubico's passkey guide gives 25 for firmware 5.0 to 5.6, while its FAQ lists 100 for them too, so look at your own key in Yubico Authenticator. Layer three: recovery codes. Google gives you ten one-time backup codes, and a new set makes the old one inactive [13]. 1Password's Emergency Kit holds your Secret Key and sign-in details, and if you turn on two-factor authentication for that account, 1Password advises writing down the 16-character secret next to the QR code [20]. Store all of these away from the devices that hold your passkeys, as Stiftung Warentest advises [9]. A printout in a drawer beats a screenshot on the phone you may lose.
- Remove old methods in the right order. When you retire a phone, remove its passkey at the service, not only on the device. 1Password states that deleting a passkey from its vault does not remove it from your account on the website [19]. Add the new method first. Microsoft warns that removing all security information puts a personal account into a restricted state for 30 days, during which security and billing changes are refused [16]. Google tells you to sign in on a device you can still use and remove the passkey of the lost one [14].
Passkey, security key and TOTP side by side
| Passkey (system or manager) | Passkey on a security key | TOTP app | |
|---|---|---|---|
| Common phishing | Resistant [4][5] | Resistant [4][5] | Not protected against real-time relay [5][8] |
| If the service leaks its data | The service holds only the public key [11] | Same | The BSI lists a weakness when secrets leak at the service [5] |
| Lost phone or key | Comes back through the provider [9][11] | Needs a second key [4] | Needs a backup or recovery codes [5] |
| Effort | Low, built in [9] | Buy and register two keys [4] | Low, but each code is typed |
Read the table as a ranking by phishing resistance, not as a ban on TOTP. The BSI says to use a second factor whenever a service offers one and not to switch it off [6]. A tested TOTP route is a good fallback. It is just not your front door.
A worked example
This is a plan for an imagined person, not a report on a real setup. Assume a phone from one maker, a laptop from another, a shared tablet at home and about 60 accounts. She picks a cross-platform manager as the home for passkeys, because her devices differ [9]. Evening one: she puts the manager's account behind an authenticator app and a security key, prints its recovery material and files it with her documents [20]. Evening two: she creates a passkey for her email account, signs out, signs in again on the laptop and on the phone, and writes down where the recovery codes live. Evening three: she repeats this for the payment services and the cloud storage, buys a second security key and registers both on the two accounts she cannot afford to lose [4]. After that she adds a passkey whenever a site offers one at sign-in, and every few months she checks the list of passkeys and methods in the security settings of her main accounts [16]. Her bank keeps its own second factor [9].
Checklist
- Decide where your passkeys live, and write down the provider account that protects them.
- Switch on a second factor for that provider account and test its recovery route once.
- Create a passkey for your email account first, then sign in with it on a second device.
- Register a second security key with every service for which you use a hardware key.
- Print your recovery codes and store them away from the phones and laptops that hold your passkeys.
- Keep an authenticator app as fallback and move the old password into your manager as a long random one.
- Remove the passkey of a retired device at each service, not only on the device.
- Review the sign-in methods of your main accounts every few months and delete the ones you do not use.