Passkeys · Reviewed

Passkeys tied to current device make logging in elsewhere complex

Raised by 51 people over 5 years (2022–2026), in 5 of them.

What people report

2022-06
if you register for a service with Firefox, you have to re-register with Chrome
Read the comment ↗
2023-12
rarely I need to use a locked down device and manually and painstakingly enter 100+ character passwords and 2FA keys
Read the comment ↗
2024-12
whenever I try to log in from a different device it doesn’t work but passwords and MFA work just fine across devices
Read the comment ↗
2025-12
But this is confusing because I cannot have an iPhone key.
Read the comment ↗
2026-10
There's seemingly no password manager that lets me export the passkey as plaintext, at least not on a Mac.
Read the comment ↗

Principle

Norman's "Conceptual model"

People report they cannot tell where a passkey lives, whether it will follow them to another browser, PC or platform, or how to recover if a device is lost, so their mental model of cross-device login breaks and they stop trusting access.

A fix

Show at enrolment and in account settings exactly which devices or password manager hold each passkey, and present cross-device sign-in (such as scanning a code with a phone) as a visible, named option on the login screen. Require users to confirm a working recovery path, like a second synced passkey or a recovery code, before setup counts as complete.

Grouping, principle and fix drafted with Claude and reviewed by Justusability. Counts are people whose comment Claude labelled a usability complaint about this issue; see Method for how, and its limits. Something wrong here?

All 57 source comments