Passkeys vs Password Manager: Do You Still Need a Vault?
Yes, you still need a password manager, and 1Password is my pick for anyone moving to passkeys, at £27.60 for a year on its 12-month plan. It suits people switching accounts over a few at a time, because its Watchtower feature flags the logins you already have that could take a passkey.
| Provider | Price a month, 12-month plan | Security score | Breaches in 5 years | Emergency access |
|---|---|---|---|---|
| LastPass | £2.60 | 7.5/10 | 1 | Yes |
| 1Password | £2.30 | 9/10 | 0 | No |
| NordPass | £1.49 | 9/10 | 0 | Yes |
| Proton Pass | £2.39 | 10/10 | 0 | Yes |
Prices and scores in the table come from Passebo's own comparison data, last checked in October 2026.
Passkeys live in a credential manager
Each passkey is a key pair tied to a single website or app, so an unrelated service can't find it. A synced passkey moves between your phone, tablet and computer through a credential manager. A device-bound passkey stays on one device, usually a security key, and can never be exported. Passkey Central suggests apps use the plainer names "passkeys on devices" and "passkeys on security keys".
Synced passkeys depend on the provider's own syncing and its security controls. Lose your phone and you get back in through that provider's recovery process, with no need to have registered a second device in advance. Apple Passwords, Google Password Manager, Dashlane and LastPass appear on Passkey Central's list of credential managers for synced passkeys, beside 1Password.
Passkey security as NCSC and FIDO rate it
NCSC's technical report found passkeys at least as secure as a password plus two-step verification, and generally more secure. Webroot puts passkeys at the top of its five security levels, above a unique password from a password manager with 2FA. The UK's NCSC now tells people not to use passwords where a passkey is on offer. Passkeys also sign people in roughly 8 times faster than a password with MFA, Webroot reports.
Security-key passkeys can meet Authentication Assurance Level 3, against AAL2 for passkeys held on devices. FIDO Alliance calls security keys the gold standard. It also says synced passkeys fall short for high-assurance uses, where a device-bound one may be required.
1Password handles passkeys on every main platform
On iPhone and iPad running version 17, and through its desktop app in a browser, 1Password can create and save passkeys. You can view, manage and share them on Mac, iOS, Windows and Android. You can also hand a passkey to someone for a short while, through a shared vault or by sharing the item. Deleting a passkey from 1Password leaves it registered with the website or app where you created it.
You can even sign in to 1Password itself with a passkey instead of an account password and Secret Key. Its own security notes rate that route robustly phishing-resistant. It is still a public beta for new Individual accounts, with existing accounts listed as coming soon. Recovery then runs through a recovery code in place of the Emergency Kit. 1Password accounts that sign in with a passkey won't work on Linux. On Windows 11, it was the first password manager to use the system's own passkey plugin.
Bitwarden and Windows 11 open up too
Bitwarden, which has no page on Passebo, offers three passkey features in its help pages, from saving and filling passkeys for other sites to signing in to Bitwarden with one and using passkeys as a second factor. Opening a Bitwarden vault with a passkey needs a browser and an authenticator that are both PRF-capable. Bitwarden caps an account at five passkeys. It also won't save the passkey for your own Bitwarden login, because you'd need the vault open to open the vault.
Microsoft added a passkey provider API to Windows 11 in November 2025, so outside managers like 1Password and Bitwarden can now look after your passkeys there. You need that month's security update before it works. Bitwarden's passkey login on Windows 11 is open to every plan, the free one included.
Password managers still guard every other login
NCSC advises keeping a password with two-step verification wherever passkeys aren't offered, stored in a password manager so each one stays long and unique. A password manager is still worth having next to a second sign-in step, Webroot argues, since attackers try reused passwords first. More than 1 billion people have turned on at least one passkey, and Google has moved over 800 million accounts onto them. Around half of Google's UK users have registered at least one, by NCSC's count.
A year of LastPass costs £13.32 more than a year of NordPass on their 12-month plans. For that extra money, LastPass gets a lower security score in the table.
Keep a vault, and let it hold your passkeys
Pick 1Password if you plan to switch accounts to passkeys, because it stores, shares and flags them across Mac, Windows, iOS and Android. Our 1Password vs NordPass comparison shows its basic paid plan has no emergency access for a trusted contact, where NordPass has it.
NordPass suits a reader who mostly needs passwords kept unique on a tight budget, since its 12-month plan costs the least of the four. It has no Travel Mode for hiding vaults at a border.
Anyone who needs the highest assurance, such as a work account that demands it, is better served by a passkey on a hardware security key.
