Passkeys were supposed to be more secure than passwords. Now they're getting hacked

Published Aug 31, 2026, 8:30 AM EDT Ever since he got his first smartphone, the legendary Nokia 6600, back in 2005, Goran became obsessed with technology. This obsession had only gotten worse after he received his first gaming PC a couple of months later. He fell in love with video games in the early '90s, shortly after embarking on his gaming journey with the Sega Master System II and SNES. Since then, he has built dozens of PCs, played thousands of games, and authored hundreds of articles about PC hardware, gaming hardware, and video games. He knows everything there is to know about the PC gaming and PC hardware space, and while his console gaming knowledge isn't as comprehensive, he considers himself a console veteran. Goran has almost a decade of experience writing about tech and video games for numerous web publications including TechSpot, TechPowerUp, and EsportsHeadlines. He has been writing for How-To Geek since December 2022. When he isn't gaming or deciding which component of his PC to upgrade next, you can find him strolling around Novi Sad while listening to music and contemplating what to play next. The promise of passkeys was a higher level of security than passwords, stemming from the fact that you can't give away a passkey. You cannot share it, and a malicious actor cannot phish a passkey like they can a password. But a recent post by Arie Olshtein, who works for cybersecurity company Palo Alto Networks, detailed a set attacks collectively nicknamed Pass-ta-key that can, in the worst case, extract all locally synced passkeys and then use them to log in to websites and do all kinds of bad things. The catch is that Pass-ta-key is possible to pull off only on Windows, and by the looks of it, only if the passkeys are managed by Google Password Manager in Chrome for Windows. Your passkeys can indeed be stolen But only under a specific set of circumstances The main reason why Pass-ta-key is possible in the first place is because the specifications governing passkeys, which are managed by the FIDO Alliance, with its members including Apple, Google, Amazon, Meta, and many other major players in the tech space, do not require passkeys to be kept in dedicated hardware. On Windows, this is the TPM (Trusted Platform Module); on iOS devices and Macs, this is the Secure Enclave, and so on. Instead, FIDO2 specifications allow passkey managers and similar solutions to store them locally on a device, in regular storage. The result is that many password managers that support passkeys do not store them in dedicated hardware in order to allow syncing between different devices, since having your passkeys locked to one device was a major reason for passkeys' slow adoption by users. The logic behind this is that many operating systems implement granular, per-app permissions, making it virtually impossible for malware to get access to locally stored passkeys, as explained by Ars Technica's Dan Goodin. On Windows, however, apps generally run with the privileges of the user who launched them, making it relatively easy for malware to access the data of another app because Windows doesn't sandbox application data in the same way. This led some Windows passkey managers to store synced passkeys in encrypted cloud-backed storage and retrieve them when needed, rather than keeping the private keys exclusively on the local device. Anyway, Google Password Manager for Windows, which was the target of the attacks, also syncs passkeys through the cloud while keeping encrypted copies of the synced passkey data locally. But unlike some other Windows passkey managers, Google's solution doesn't use some of the OS-level defense mechanisms used by other Windows passkey utilities, making it vulnerable to Pass-ta-key attacks, which exploit these weaknesses to take over passkey-protected accounts and, in the worst case, as demonstrated by the Golden Pass-ta-key attack, extract all synced passkeys stored in Google Password Manager. The attackers can do what they want with the extracted passkeys, including selling them on the credential black market. In general, though, passkeys are as secure as ever This isn't a problem with passkeys themselves Credit: Lucas Gouveia / How-To Geek While this sounds concerning on the surface, the reality is that passkeys are more or less as safe as ever. Pass-ta-key attacks can only work on Windows, and only if the device in question has already been compromised by malware. The attacks also specifically exploit Google Password Manager because the platform doesn't use some of the Windows defense mechanisms available to it, which other Windows passkey utilities use, making it vulnerable to malware, which can not only take over passkey-protected accounts but also extract passkeys. In general, you don't have many reasons to be concerned. Firstly, Pass-ta-key is a demonstration created and shared in full by a security researcher, not a new type of attack discovered in the wild. This allows Google to potentially improve its Password Manager for Windows and make it more in line with other Windows passkey solutions. It also allows developers of other solutions to make their Windows versions even more secure and even more resilient against malware that could use techniques similar to those shared by Arie Olshtein. Next, if you're using Google Password Manager on your Windows machine for passkey management, you can simply opt for another solution. While you can start using a password manager that supports passkey syncing, you can also use one that stores passkeys in dedicated hardware, such as Windows Hello, which can store passkeys in the TPM, or a YubiKey, neither of which is vulnerable to the Pass-ta-key attacks demonstrated by Arie and Unit 42. Using a password manager with a TOTP app is still a very secure alternative for most people While many passkey management solutions now support syncing between different devices, removing one of the biggest downsides of passkeys—the fact that they are locked to a single device—passkeys are still not ready to replace passwords entirely. They still have issues working between different platforms, can involve more work than simply autofilling a password field with your favorite password manager, and restoring them still often involves traditional methods such as email, SMS, or backup codes. At the end of the day, you don't have to use passkeys in the first place. A password manager combined with a TOTP (time-based one-time password) app does the trick for most people. It's fairly secure, convenient, works great across platforms, and if you lose access to your TOTP app, you'll still be able to log in to websites where you use TOTP, as long as you have a backup recovery method available. For instance, I lost access to my TOTP app when my previous phone broke, but I managed to regain access to every single site I use TOTP for.