> ## Content Index
> Fetch the complete content index at: https://birchtree.me/llms.txt
> Use this file to discover other available public pages before exploring further.

# Passkeys are a trap. No they're not!
- URL: https://birchtree.me/blog/passkeys-are-a-trap-no-theyre-not/
- Published: 2026-10-22T23:21:00.000Z
- Updated: 2026-10-22T23:20:59.000Z
- Author: Matt Birchler
- Tags: Links

Shot: [Passkeys are a trap. Do not use them.](https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them?utm%5Fsource=scotthelme.co.uk)

> Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.

Chaser: [Passkeys Are Not a Trap](https://scotthelme.co.uk/passkeys-are-not-a-trap/?ref=birchtree.me)

> The post holds up TOTP as "already" a great solution. TOTP is better than a password alone, absolutely, but it has one big weakness: you can type the code into the wrong website, just ask my good friend Troy Hunt. Phishing kits like Evilginx sit in the middle, relay your password and code to the real site in real time, and walk away with your session. This isn't theoretical, it's how a huge number of account takeovers happen today and we have the evidence to prove it.

I continue to think the rollout of passkeys across the industry has been pretty poor. I like them, and my products rely on them as the primary form of authentication. I literally don't do passwords anywhere.

Passkeys are a very good solution, but people don't understand them and they're not something you can "hold in your hands", which has made passwords fundamentally appealing to a lot of people. It may not be great for security if you can write your passwords down in a notebook or on a post-it, but they were something people understood. Passkeys are some anomalous thing you aren't meant to understand, and people don't love that.

It also doesn't help that passkeys require you to use a password manager, at which point it must be asked, doesn't a password manager solve a lot of the problems passkeys are supposed to solve anyway? But I digress. And the fact that passkeys were 100% locked to whatever password manager you chose for the first several years they were around has not helped the narrative that they are some sort of open standard that you own. It really feels to everyone that whatever password manager you use owns these keys.

For my part, I continue to use passkeys whenever possible in my personal life. They make signing in easier, and they avoid me getting those godforsaken two-factor notifications that drive me up the fucking wall. As a developer, I use them in my apps because they're a hell of a lot safer than me trying to secure your passwords on my server.