Passkeys, Password Managers & Two-Step Verification: Which Do You Need?
Passkeys, password managers and two-step verification do different jobs. See what each does, which you need and how to set up passkeys on Apple devices.
These three things are often mixed up, but they do different jobs, and they work best together. The short answer is to use passkeys wherever a site offers them, a password manager for everything else, and two-step verification on any important account that still uses a password.
What each one does
A password manager remembers a different, strong password for every account and fills it in for you, so you never reuse one. On an iPhone or Mac that is the Passwords app. Our guide to the Apple Passwords app explains what it does and where it stops.
Two-step verification adds a second proof when you sign in. After your password, you enter a code, so someone who has your password still cannot get in.
A passkey replaces the password altogether. Your device creates a unique one for each account, and you approve it with Face ID, Touch ID or your passcode. There is nothing to type, and nothing for a criminal to steal.
Why a passkey beats a code
A code can be typed into a fake sign-in page along with your password. That is how some accounts are taken over even when two-step verification is switched on. Our guide to what to do if your account is compromised explains how it works.
A passkey only works on the real website it was created for, so it cannot be handed over to a fake one. Apple says passkeys are less vulnerable to phishing than passwords, and Microsoft describes them as phishing-resistant by design.
Microsoft has begun making passkeys the default way to sign in to Microsoft 365 work accounts, starting from 1 September 2026. It plans to stop delivering text-message and phone-call codes for work accounts on 1 February 2027. If you use Microsoft 365 at work, expect a prompt to set up a passkey.
Which do you actually need
Everyone needs a password manager and two-step verification. Add passkeys wherever they are offered, starting with your email, your Apple Account, your Microsoft account and your banking.
If you run a business, use the same approach, but choose a business password manager instead of sharing passwords through personal accounts.
Start in this order. First, turn on two-step verification for your email and your Apple Account. Second, open the Passwords app and fix any passwords it marks as weak, reused or found in a data leak. Third, create a passkey whenever a site offers one.
Setting up passkeys on an iPhone or Mac
Passkeys are stored in iCloud Keychain, Apple’s secure storage that keeps your passwords and passkeys up to date on every device signed in to your Apple Account. To use passkeys, iCloud Keychain and two-factor authentication need to be switched on.
When a website or app offers to save a passkey, tap Continue. Next time you sign in, tap your account name and approve with Face ID or Touch ID. On a Mac without Touch ID, you can scan a QR code with your iPhone instead.
If you do not see the option, that website does not support passkeys yet. You can keep your password alongside a passkey, and the passkey is not visible to anyone, including Apple.
Do not lock yourself out
If your iPhone is your only trusted device, and the only device that receives your verification codes, losing it can lock you out of your Apple Account. Add a second trusted device or a second trusted phone number, one that is not tied to your iPhone, before you need it.
Need a hand?
If you would like help setting up passkeys, a password manager or two-step verification for your family or your team, see our Online Safety & Protection service, our Security & Email Protection service for businesses, or contact Your Mac Tech.
