Passkeys or a Password Manager First? A Practical Order

Almost everyone asks this as a choice between two products. It is not. You will end up with both, and the only decision that changes anything is the order you set them up in — because one order always leaves you a way back in, and the other can quietly lock you out.

People frame it as "should I switch to passkeys, or get a password manager?" That assumes the two do the same job. They don't. A passkey is a way to log in without a password on the sites that support it; a password manager stores and fills everything the passkey does not cover — still most of the internet, for most people.

Why it is not either/or

Three facts keep both tools in your life:

• Passkeys are per-site. A service only accepts a passkey if it has built passkey support. Every account that has not still wants a password, and that password needs somewhere to live.
• Passkeys are not stored like passwords. A passkey is a key pair: the public half sits on the website, the private half stays wherever your credentials live — your device's keychain, or your password manager. So the real question is not "passkey or password manager?" but "where do my private keys live, and what happens if I lose that place?"
• The password manager is often the passkey store. Many password managers can now hold passkeys as well as passwords, collapsing the two into one vault instead of two — an argument for choosing the vault first, not the passkey first.

The dependency direction still points at recovery

It is tempting to imagine a passkey-only future where recovery no longer matters. It always matters, for three reasons:

• Not every site you use supports passkeys, so you keep passwords regardless.
• A passkey lives on a device or in a vault. Lose, wipe, or replace that device and the passkey can go with it — see what to do when you lose the phone.
• When a passkey is not available, sites fall back to email resets and backup codes — so the asset that saves you is a recovery-ready email account plus offline codes, not the passkey itself.

Recovery is the foundation and the passkey is the roof; build the foundation first. Our notes on passkey backup and recovery cover what to store and where.

The order that avoids lockouts

Whatever you choose, do it in this sequence:

1. Secure the email account you use for resets: a strong unique password, a second factor, and a recovery code kept offline.
2. Put a password manager in place as your vault. This is the layer that makes passkeys recoverable instead of stranded on one device.
3. Turn on a time-based second factor (an authenticator app) for the accounts that matter, and store the recovery codes offline.
4. Add a second way in for every important account — a second factor, a second device, or a security key — before you remove any old method.
5. Only then start adding passkeys.

The rule underneath all of it: never let the new method become the only door. Add the passkey while the password and the second factor still work, prove you can still get in, and only then decide whether to retire the old password.

What to migrate first

• Start with low-stakes, daily-use accounts — ones where a mistake is annoying but recoverable. You want to learn the flow before your money or your identity depends on it.
• Migrate accounts you use on devices you own. A passkey created on hardware you will not have tomorrow is a liability, not an upgrade.
• Leave your primary email account for later. It is the anchor every other reset flows through, so switch it once you already know how passkey prompts behave on your own devices.
• Create passkeys from inside your password manager where it supports them, so the private key travels with you instead of being pinned to one browser profile. If you are still choosing a vault, our passkey-aware comparison lists the questions to ask.

What to leave alone

• Borrowed, public, or shared computers. Do not create a passkey on a machine that is not yours, and be careful about leaving a persistent login behind on it. Our troubleshooting notes cover what to do if one is already stuck.
• Devices that cannot store a passkey. Keep using a password and a second factor there instead of fighting the platform. a device with no place to keep credentials will not grow one by trying harder.
• Any account where the only option offered is a passkey with no way back in. That is unusual, but check before you commit; if there is no fallback, keep a password or a recovery code active alongside it.
• Accounts you open a few times a year. There is no urgency; migrating a rarely used account rarely pays off and adds one more thing to remember.

Decision table: which to do first

Goal	Do this first	Why
Stop reusing the same password everywhere	A password manager	One change fixes the real problem across every site at once, including the many that still have no passkey option.
Make logins harder to phish	Passkeys on supported accounts	A passkey is bound to the real site, so it will not be offered up to a lookalike login page.
Never be locked out of your email	A recovery-ready email account and an offline code	Nearly every account reset runs through that mailbox; it is the root, so secure it before anything else.
Sign in on a brand-new device	A password manager that can hold passkeys	A passkey stored only on one device may not follow you; a synced vault can.
Cover sites that have no passkeys at all	A password manager	Those accounts still authenticate with a password, and it needs a home.
Try passkeys with no risk	A test or demo account	You learn the prompts and where the key lands before you touch a real login.

How to remember it

Pick the vault first, because it is where both your passwords and your passkeys will live. Secure recovery before you secure convenience. Add the new method while the old one still works, and retire the old one only after the new one is proven on a second device.

If a login misbehaves along the way, our passkey troubleshooting notes walk through the common causes one by one.

Last updated: 2026-10-16