1. Passkeys feel opaque and hard to manage
Users complain that the technology is “hidden” and that they can’t see or control what they’re actually storing.
- SoftTalker: “Managing them looks complicated and I don’t understand the ramifications of what I’m doing.”
- pibaker: “Passkeys are designed to be hidden from the user… people can’t get a grasp on passkeys… they keep losing their accounts for no good reason.”
- petee: “I started deleting every entry I couldn’t immediately recognize… I didn’t know these were passkeys.”
2. Security benefits clash with the risk of losing access
Passkeys are praised for phishing resistance, but many users fear that a lost device or accidental deletion will lock them out forever.
- realityking: “One advantage of passkeys is that they’re phishing‑resistant… bound to the website you created them for.”
- bensyverson: “If you encrypt data with a generated password and then delete it, you’re toast, and passkeys are no different.”
- pibaker: “If you lose the device, you lose the key and any data encrypted with it. The recovery process can be a nightmare.”
3. Attestation and platform lock‑in create distrust
The spec’s attestation feature and the way big‑tech ecosystems handle passkeys raise concerns about vendor control and future restrictions.
- hedora: “The standard includes a hardware attestation path… that’s the backdoor allowing the eventual takeover of your OS.”
- johncolanduoni: “Attestation is not about the OS or browser; it only attests to the device that holds the key.”
- hedora: “If they make attestation mandatory, you’ll be forced to use a patched OS with an attestation bit set in the key.”
4. Fragmented ecosystem and inconsistent support
Different browsers, OSes, and password managers implement passkeys in incompatible ways, leading to confusion and broken workflows.
- peterspath: “Bitwarden doesn’t export passkeys; Firefox on Linux can’t use them; Chrome on Windows works, but not everywhere.”
- buzer: “Passkeys are broken on PC/Linux when using Firefox… you have to use Chrome or Edge.”
- peterspath: “Some password managers inject JavaScript to handle passkeys, which is fragile and not universally supported.”
These four themes—opaque UX, security‑vs‑access trade‑offs, attestation/lock‑in fears, and ecosystem fragmentation—dominate the discussion.