# Passkeys in 2026: The 20 minute switch, and the three accounts to do first

> How to set up passkeys in 2026 in the right order. Platform sync first, then email, then your password manager. The order matters more than the twenty minutes.

- Published: 2026-08-28
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/passkeys-setup-order-2026/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- The FIDO Alliance put active passkeys worldwide at around 5 billion in May 2026
- Do email before anything else, because email is the reset path for every other account you own
- Always keep one working backup sign in method, or a lost device becomes its own kind of lockout

## Article

Converting your main accounts to passkeys takes about twenty minutes. The order you do it in matters more than the twenty minutes do, and most guides get the order wrong.

The [FIDO Alliance](https://www.authgear.com/post/passkey-vs-password-why-passkeys-are-the-future-of-security/) put active passkeys worldwide at around 5 billion in May 2026. Apple, Google and Microsoft support them on every current platform, and the service list now includes Amazon, PayPal, GitHub, most banks and the major password managers. Availability stopped being the blocker a while ago.

## How to set up passkeys in 2026, in order

- Turn on platform passkey sync first: iCloud Keychain, Google Password Manager or Microsoft's manager. Do this before you create a single passkey, or you will make one that lives on exactly one device.
- Email account second. Email is the reset path for everything else you own, so it is the account whose compromise costs the most.
- Password manager third.
- Bank and payment accounts fourth.
- Keep one working backup sign in method on every account you convert.
- Check the device list quarterly and remove phones you no longer have.

## The bit people get wrong about phishing

A passkey is a cryptographic key pair where the private half never leaves your device. There is nothing to phish, nothing to guess, and nothing useful for an attacker to lift from a breached server.

The part that actually kills phishing is not the fingerprint. It is that the credential is bound to the real domain. A convincing fake login page cannot trigger the sign in at all, because the browser refuses to sign for the wrong origin. The human judgement step, the one where you squint at a URL, is removed from the process entirely. We went through the mechanics in more depth in [our explainer on why passwords are dying](https://futuretechnologyhq.com/article/passkeys-explained-passwords-dying/).

## Passkeys are not immune to everything

They solve phishing and credential stuffing. They do not solve a compromised device, which is why [malware that goes after synced passkeys](https://futuretechnologyhq.com/article/google-passkey-theft-malware-2026/) exists. Sync is a convenience and a slightly larger blast radius at the same time, and that trade is usually worth taking.

## The backup method

A passkey tied to a single device you then lose is a lockout waiting to happen. Platform sync covers most of that risk. If you want a backup that does not depend on one vendor's cloud staying available, a hardware key is the cleanest option, and the [YubiKey 5 NFC](https://www.amazon.co.uk/dp/B07HBD71HL?tag=futuretech0d6-21) still covers the widest set of services with one device.

Buy two if you go that route. One lives in a drawer. That is the actual advice, and it is the step people skip.

Some links in this article are affiliate links. We may earn a small commission at no extra cost to you.

## Key takeaways

- Turn on platform passkey sync first to avoid creating a passkey tied to a single device.
- Email account should be converted second, as it is the reset path for other accounts.
- Password manager should be converted third, after email account.
- One working backup sign in method should be kept on every account converted.
- The device list should be checked quarterly and phones no longer in use removed.

## Sources

- [Authgear](https://www.authgear.com/post/passkey-vs-password-why-passkeys-are-the-future-of-security/)
- [Silent Security](https://silentsecurity.net/resources/passkeys-guide/)