Why Your Passkeys Don't Follow You From iPhone to Android
Passkeys are supposed to replace passwords entirely, but a credential created on an iPhone often can't be used on an Android phone. Here's the design decision behind it.
Five billion passkeys are now in use worldwide, according to the FIDO Alliance, which tracks the standard behind the "sign in with your face or fingerprint" prompts that have replaced passwords on most major apps over the past two years. Three-quarters of people have turned one on for at least one account. And a large share of them have hit the same confusing wall: a passkey created on an iPhone simply refuses to show up on an Android phone sitting on the same desk.
It isn't a bug. It's a design choice two companies made separately, and it's the single biggest source of passkey complaints from people who did everything the setup screen told them to.
Why don't passkeys sync between iPhone and Android?
A passkey is a cryptographic key pair defined by the WebAuthn standard: a private half that never leaves your device and a public half the website stores. On an iPhone, that private key lives in iCloud Keychain. On an Android phone, it lives in Google Password Manager. Apple and Google built separate, closed systems for storing and syncing those keys, and neither talks to the other. A passkey you create signing into your bank on an iPhone is generated inside Apple's ecosystem and stays there; switch to an Android phone and that same bank account has no record of ever seeing a passkey from you, because as far as Google's system is concerned, none exists.
This is different from how, say, a photo library or a note syncs. Those are files moving through one company's cloud. A passkey's private key is deliberately built so it can't be copied out to just anywhere: that's what makes it resistant to phishing in the first place. The security feature and the syncing headache come from the same design decision.
The cross-device workaround, and where it breaks
FIDO built a fallback for exactly this gap: hybrid transport, the QR-code flow you may have seen when logging into a laptop with your phone. You scan a code, your phone verifies you with Face ID or a fingerprint, and a Bluetooth handshake confirms the two devices are physically near each other before the login completes. It works, but it depends on both devices having Bluetooth on, both being within range, and the flow not timing out, three separate points where a coffee-shop login attempt can fail for no obvious reason. It also isn't the same as actually having the passkey live on the second device; you're borrowing the first device's credential each time rather than gaining a portable one.
Chrome has added the ability to sync its own password-manager-stored passkeys across whatever platforms Chrome runs on, which helps people who standardize on one browser but doesn't touch keys created through Apple's or Google's native system prompts instead of the browser. It's a similar flavor of friction to the login screen every public Wi-Fi network throws up: a security step that works fine until you're the edge case it wasn't built for.
What is a passkey, and is it actually safer than a password?
The security case is not close. FIDO's 2026 data puts passkey sign-in success at a real-world level far above password attempts, and one in three people surveyed said they'd had an account compromised or gotten a breach notice in the past year — a problem passkeys are specifically built to prevent, since there's no shared secret sitting on a server for an attacker to steal. There's also a blunter, more human number behind the pitch: 47% of consumers say they're likely to abandon a purchase or a sign-in entirely when they can't remember a password, and 17% call themselves highly likely to walk away. A credential nobody has to remember doesn't just close a security hole; it closes a checkout-abandonment hole too.
Do I need a password manager if I use passkeys?
For now, yes, if you use more than one type of device. The practical fix isn't waiting for Apple and Google to open their vaults to each other (neither has signaled plans to). It's using a third-party credential manager built to work across both, such as 1Password, Dashlane or Bitwarden, which store passkeys independently of either company's ecosystem. That adds a step at setup, but it's the only way to make a single passkey follow you from an iPhone to a work laptop to an Android tablet without re-registering it three separate times.
Security teams have started building for this reality rather than around it. The current guidance inside most identity platforms is to treat a passkey as the primary sign-in method but never the only one, pairing it with a one-time code or a magic link so a person isn't locked out entirely just because their credential happens to be trapped in the wrong company's cloud.
That's a strange place for the industry to have landed nine years after FIDO2 was finalized: the cryptography solved the phishing problem outright, and the thing still standing between passwords actually disappearing is two Silicon Valley companies declining to let a key cross a fence they each built — not entirely unlike the way manufacturers still lock parts to specific devices even after right-to-repair laws required otherwise. Ecosystem walls, it turns out, are hard to legislate or engineer away, whether the thing trapped behind them is a screen or a login.
