Why I Still Shun Passkeys

Jeff Johnson explains why he continues to avoid passkeys, arguing they reduce user control and break two practical requirements he insists on: being able to sign into a website from a device that is new to him without signing that device into a web service, and being able to make reliable, redundant backups of credentials. Passwords satisfy those needs because they can be read, typed, written down, or memorized; passkeys push users toward credential managers or hardware tokens. Hardware tokens like YubiKeys are inconvenient and unbackable, and vendor-driven credential-exchange protocols don’t help someone who never intends to migrate between credential managers or platforms.

His specific gripe centers on Apple’s ecosystem: macOS now requires iCloud Keychain to save a passkey on a Mac, which prevents local backup or manual management of a passkey database. Johnson rejects reliance on iCloud Keychain (and third-party managers) because Apple’s design choices sabotage traditional backup workflows and lock users into paternalistic defaults that harm both sophisticated and unsophisticated users. He frames the issue as oversimplification and vendor lockdown that obstructs practical workflows and the ability for experienced users to help others, and says he would only switch to passkeys if Apple allowed local, user-managed storage and straightforward backups.