iPhone Passkeys: iCloud Keychain vs a Password Manager

A passkey on an iPhone lands in one of two vaults, and the phone picks the first for you unless you change a setting. Here is which layer wins by default, how to find where a specific passkey lives, and what the split costs you when you change phones.

The layer that wins by default

Out of the box, an iPhone has one credential provider switched on: iCloud Keychain. It needs no extra app and no subscription, so when a site offers to create a passkey it is saved to Keychain, tied to your Apple Account and synced to the other Apple devices signed into that account with Keychain enabled.

A third-party password manager only becomes a storage layer for passkeys after two things happen: you install it, and you set it as the default autofill provider in iOS Settings. Until then it may still fill your passwords on websites, but new passkeys keep going to Keychain.

What happens if you stop paying for a manager

Ask this before subscribing anywhere, because policies differ. Common patterns: the vault goes read-only, so existing items still work but nothing new is saved; paid features lock and stored items become inaccessible; or there is a grace period followed by deletion. Vendors usually state the policy on their billing help pages, so read it rather than assume.

Whatever it says, treat a lapsed account as an unusable passkey store. Passkeys are not yet portable in a uniform way — import and export support varies by vendor and by operating system — so losing access can mean re-registering passkeys at each site while you are still signed in some other way. Two questions are worth asking any vendor in writing: can passkeys be exported, and is there a documented recovery path if you lose the device and the second factor? More in password managers with passkey recovery and passkey backup and recovery.

Decide first whether you need a manager for passkeys at all. If every device you use is an Apple device, Keychain already covers you: see passkey or password manager first.

The split is normal — most people end up with both

Installing a manager does not give you a clean migration. You usually end up with three groups:

• Keychain only — anything registered on the iPhone before the manager became the default provider, or on sites that only ever prompt there.
• Manager only — passkeys registered after you changed the default provider, or while signed in on a desktop.
• Both — two separate passkeys at the same site, each labelled with the device or provider that created it.

That is not damage: a site can accept several passkeys at once, each one independent. The problem is not duplication, it is not knowing which is which before you wipe a phone or cancel a subscription.

How to find out where a given passkey lives

1. On the iPhone, open Settings → Passwords and search the site's domain. Anything listed is held by Keychain.
2. Search the same domain in the third-party manager's app. Anything listed there is held by that manager.
3. Sign in to the site and open its security settings. Most list registered passkeys with a name — often the device or provider — and a last-used date. That list is authoritative, because it shows what the site will accept.
4. Match the names. If the site lists two and only one matches your current phone, the other is in the other layer.
5. If the site lists none, no passkey was ever created — the prompt was dismissed, or the site fell back to a password.

Moving to Android or a desktop

• Android: Keychain does not run there, so its passkeys cannot be used from an Android phone. Android's own default provider means your accounts start collecting passkeys in a second, unrelated vault. You cannot merge them; you add a new passkey at each site while signed in.
• Mac: Keychain passkeys keep working if you are signed into the same Apple Account with Keychain enabled. A third-party manager only comes along if it has a Mac app.
• Windows and Linux: Keychain does not exist there, so a passkey held only in Keychain is unusable from those desktops. If your work machine is Windows, the layer that travels is a manager with a desktop client — worth weighing in the passkey manager comparison.
• Cross-device sign-in: many sites let you scan a QR code and use the passkey on your phone while signing in elsewhere. Handy once, but not a storage strategy and no help if the phone is gone.

How to make one layer authoritative on purpose

Rather than letting the phone decide, pick the vault you want and demote the other. Order matters: passkeys generally cannot be copied between providers, so every move is a fresh registration.

1. List the devices you must sign in from, and choose the layer that reaches all of them.
2. Set that layer as the default autofill provider in iOS Settings, installed and signed in on every device on your list.
3. Move priority accounts first. Sign in with a password or an existing passkey, open security settings, and add a passkey — it is created in whichever layer is currently default.
4. Prove it works before removing the old one: sign out, sign back in with the new passkey, and repeat on a second device.
5. Then delete the unwanted passkey from the site's own list rather than from the app, so no stale entry is left behind.
6. Do not leave two autofill providers enabled and hope. Two active providers is exactly how duplicate passkeys and confusing prompts are made.

If you get stuck partway — a passkey that will not offer itself, a site that keeps falling back to the password — work through passkey troubleshooting before guessing at settings, and keep what to do with a lost phone to hand.

Last updated: 2026-10-16