Nuts and bolts of using Passkeys

Hello jmjm​! 👋

Thanks for reaching out! Passkeys are a modern alternative to passwords – they enable people to log in to their online accounts without having to enter a password. Passkeys are based on a public-private key pair – one key is public and connected to the website or app you’re using, the other key is private and stored in 1Password.

Once you've created and saved one passkey for an account using 1Password on one device there's no need to create another passkey using 1Password on another device. 1Password makes sure that the passkey that you saved on one of your devices will be immediately available for sign-in on the rest of your devices. Passkeys are encrypted and saved directly to your 1Password account just like passwords and other items that you already store in 1Password. 

You can read more about saving and signing in with passkeys here:

• Save and sign in with passkeys in your browser
• Use 1Password to save logins and sign in to apps and websites on your iPhone and iPad
  
  

But (any)one can still log into my GMail account using that long held password (but still needing one of my 2FAs?). So still being able to sign into my GMail account traditionally seems like a security flaw?

Passkeys can’t be phished like a traditional password because the underlying private key never leaves 1Password – this also makes them resistant to the social engineering scams that 2FA is primarily meant to protect against. 

Some websites will allow you to remove the username/password entirely but others require that you keep both options. Part of the reason why many services leave passwords as a fallback option is because, for their website and apps, passkeys may not be supported across all devices and platforms yet. Even if you can't remove your old password then you still get the benefit of increased protection from phishing every time that you use your passkey to sign into a website or app.

If you do keep your passwords alongside your passkeys for certain websites, make sure that all of your passwords are strong and unique: Use the password generator to change and strengthen your passwords

Let me know if you have any other questions. 

-Dave