Passkeys remove the shared secret that makes passwords vulnerable to phishing. For a normal sign-in, the improvement is immediate: there is nothing to type and nothing useful for an attacker to steal from a fake page.
The recovery gap
Problems begin when a user loses every enrolled device or changes platforms. Providers must balance a humane recovery path against the risk of turning support channels into a bypass.
Authentication is only as strong as the least carefully designed way back into the account.
The best systems make recovery settings visible before a crisis and explain, in plain language, which trusted devices or contacts can help.
