Passkey unlocked using device passcode

Hi,

A silly question, maybe, regarding unlocking 1Password with a passkey.
I was one of the private beta users and, while I found it very convenient, there is an aspect that worries me a lot. Probably it’s just me not understanding the details, that’s why I am asking here.

In the blog post describing the introduction of passkeys to unlock 1Password (https://blog.1password.com/unlock-1password-individual-passkey-beta/) you can read:

“Once you’ve created a passkey, you can unlock 1Password by using biometrics or, as a fallback, the passcode that protects your device. You can then use your first device to set up more trusted devices with 1Password.”

Let’s imagine that someone has access to my iPhone and tries to get into 1Password.
Biometric will not work, as his face is different from mine.

With the current master password, he needs to guess a long and complex sequence of letters, numbers and special characters. Very difficult.

With the passkey, he will only need to guess the passcode that protects my device. Much easier than my master password.

Entropy level of the secret key of the passkey pair can be as high as possible, but if anyone can access it with the phone passcode (usually 6 digits, nobody will ever use a 26 characters random password as a phone passcode), can someone explain me how the passkey is as safe as the master password in a situation like the above?

Thanks!

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser: Not Provided