Passkey vs Security Key: Which to Use?

Google, Apple, or Microsoft just asked you to "create a passkey," and you already own a YubiKey. Did the last few years of hardware-key advice just become pointless? No — but the two solve different problems, and most guides answering this question are written for IT admins deciding enterprise policy, not for you deciding what to do with your own accounts tonight.

TL;DR

A passkey is a credential stored on or synced by your device/ecosystem (Apple, Google, Microsoft); a security key is physical hardware, independent of any ecosystem. Both run on the same FIDO2/WebAuthn standard.
Synced passkeys travel with your account across devices and survive a lost phone via cloud recovery. Device-bound passkeys stay on one device only, closer to how a hardware key behaves.
Passkeys win on convenience and cost (free, Face ID/fingerprint fast). Security keys win on independence — they don't depend on any single phone, cloud account, or ecosystem staying accessible.
The single point of failure most people miss: if all your synced passkeys live in one Apple or Google account and that account gets locked, you can lose access everywhere at once.
The practical answer for most people is both — synced passkey for daily convenience, a hardware key registered as backup on the accounts that matter most.

KEY-STAT: 2 — the number of distinct passkey types (device-bound and synced) that get lumped together as "passkeys" in most coverage, even though they behave very differently if you lose your phone.

The one-sentence difference

A passkey is a cryptographic credential that lives on your device or is synced through your Apple, Google, or Microsoft account. A security key is a separate physical object — plug it in or tap it via NFC — that isn't tied to any of those ecosystems. Under the hood, both use the same FIDO2/WebAuthn standard, which is why a security is often described as "a passkey you can hold."

Device-bound vs synced passkeys

Not all passkeys behave the same way, and this is the distinction most consumer coverage skips entirely:

Synced passkeys (iCloud Keychain, Google Password Manager) copy your credential across every device signed into the same account, and can be recovered if you get a new phone. Convenient, but your access now depends on that cloud account staying available to you.
Device-bound passkeys are generated inside one piece of hardware — a security key, or a platform authenticator like Windows Hello — and the private key never leaves it. No syncing, no cloud dependency, but also no automatic recovery if that one device is lost.

Note

A YubiKey registered as a passkey is a device-bound passkey. This is why a hardware key still matters even on services that now support passkeys natively — it's the device-bound option without needing a specific phone or laptop's built-in authenticator.

Comparison table: passkey vs security key

	Synced passkey	Device-bound passkey	Physical security key
Cost	Free	Free (uses built-in hardware)	~€25–70 per key
Portability	Syncs across your ecosystem's devices	Stays on one device	Plugs into any device
If lost	Recoverable via cloud account	Not recoverable — that device is gone	Recoverable if you registered a backup key
Cross-ecosystem use	Locked to Apple/Google/Microsoft account	Works wherever that device authenticates	Works across Windows, macOS, Linux, Android, iOS
Phishing resistance	High (FIDO2/WebAuthn)	High (FIDO2/WebAuthn)	High (FIDO2/WebAuthn)
Best for	Daily logins on your own devices	Advanced users wanting no cloud dependency	Account recovery backup, shared/work machines

Where a passkey wins

Passkeys cost nothing, use hardware you already own, and log you in with a fingerprint or Face ID instead of typing anything. For the accounts you access constantly from your own phone and laptop, a synced passkey is faster than a physical key every single time.

Tip

If you haven't set up passkeys yet on your main Google or Microsoft account, do that first — it's free and takes under a minute. A hardware key is what you add on top for the accounts that matter most, not a replacement for starting with passkeys.

Where a security key wins

A security key doesn't care which phone you own, whether your cloud account is locked, or whether you're logging into a Windows PC from an Apple ID. It's the same physical object regardless of ecosystem, which matters if you regularly cross between Windows, macOS, and Linux — a scenario synced passkeys handle poorly since Apple's and Google's passkey syncing don't talk to each other.

It also doesn't depend on your phone having battery, signal, or being unlocked. For SSH access to a homelab server, as covered in our YubiKey setup guide, that independence is the entire point.

The single point of failure most people miss

Synced passkeys are genuinely convenient, but they concentrate risk in one place: the cloud account doing the syncing. If your Apple ID or Google account gets locked, flagged, or you lose the phone before a new device finishes syncing, every synced passkey tied to that account becomes unreachable at the same time — not just one login, all of them.

Warning

Don't let your only recovery method for your primary email or password manager be a synced passkey tied to the same ecosystem account. If that account locks you out, you've lost the recovery path along with the login. Register a hardware key as a second, independent factor on those specific accounts.

The practical answer: use both

There's no single winner here, and most "passkey vs security key" content tries to force one. The workable setup:

Synced passkey for the accounts you log into daily from your own devices — fast, free, no extra hardware to carry.
Physical security key registered as a backup on the handful of accounts where losing access would actually hurt: primary email, password manager, and your main Google or Microsoft account.

That mirrors the setup covered in our earlier guides on what a YubiKey actually protects and how to register one for 2FA and SSH — passkeys handle the everyday logins, the hardware key handles the accounts you can't afford to lose.

Frequently asked questions

Do I still need a security key if I use passkeys?

Not for every account, but yes for the ones that matter most. Passkeys cover daily convenience well; a hardware key is worth keeping as an independent backup for your primary email, password manager, and main cloud account, since it doesn't depend on any single phone or ecosystem account.

What happens to my passkeys if I lose my phone?

Synced passkeys recover through your cloud account (iCloud Keychain, Google Password Manager) once you sign into a new device. Device-bound passkeys — including ones stored on a hardware security key — do not recover; that's why registering a second backup key matters if you rely on device-bound passkeys.

Are passkeys more secure than a YubiKey?

Both use the same FIDO2/WebAuthn standard and offer the same phishing resistance. The security difference isn't the credential itself — it's that a synced passkey depends on your cloud account staying accessible, while a hardware key doesn't depend on any account at all.

Can I use a passkey and a hardware security key on the same account?

Yes — most services that support passkeys let you register multiple authenticators, including both a synced passkey and a physical security key, on the same account. Registering both is exactly the setup recommended above for accounts that matter most.