Short answer: Yes, you still need an authenticator app in 2026 — but fewer accounts need it than a year ago. Passkeys are strictly stronger than TOTP codes because they cannot be phished, and where a site offers passkeys you should use them. The catch is coverage: most banks, exchanges, government portals, and smaller services still do not support passkeys at all. Keep your authenticator app for those, and keep your backup codes regardless.
What a passkey actually is
A passkey is a cryptographic key pair. When you create one, your device generates a private key that never leaves it and hands the website a matching public key. To log in, the site sends a challenge, your device signs it with the private key, and the site verifies the signature.
You approve the signing with your face, fingerprint, or device PIN — which is why passkeys feel like biometric login even though your fingerprint is never transmitted anywhere.
The important part is that the private key is bound to a specific domain. A passkey created for paypal.com will not sign a challenge from paypa1.com. Your browser refuses. That binding is what makes passkeys phishing-resistant, and it is something no six-digit code can do.
Why TOTP codes are still phishable
An authenticator app has no idea what site you are looking at. It generates a code; you type it wherever you like. If a convincing fake login page asks for it, you will hand it over — and the attacker relays it to the real site within its 30-second window.
This is not a theoretical weakness. Real-time phishing kits automate it entirely. As we explain in our breakdown of how TOTP codes actually work, the algorithm is sound; the human in the loop is the gap.
Passkeys close that gap structurally. There is no secret for you to leak, because there is nothing to type.
Where passkeys fall short
Coverage is still patchy
Google, Apple, Microsoft, Amazon, PayPal, GitHub and a growing list of large services support passkeys. Your regional bank, your utility company, most crypto exchanges, and the long tail of smaller sites do not. You cannot use a method a site does not offer.
Recovery is genuinely harder
Lose every device holding a passkey and you are in account recovery — the same territory as losing a phone with 2FA. Platform sync (iCloud Keychain, Google Password Manager) mitigates this by replicating passkeys across your devices, but it also means your passkeys are only as safe as that platform account.
Cross-ecosystem friction
A passkey created in iCloud Keychain does not automatically appear on a Windows PC. You can scan a QR code with your phone to authenticate, which works, but it is clumsier than typing six digits. Cross-platform password managers like 1Password and Bitwarden solve this if you are willing to store passkeys there.
Many sites treat passkeys as an addition, not a replacement
Plenty of services let you add a passkey while leaving SMS or TOTP enabled as fallbacks. If the weaker method stays active, an attacker will simply target it. Your security is set by the weakest enabled option — a point we make in detail in our SMS vs authenticator app comparison.
The practical hierarchy in 2026
- Hardware security key (YubiKey, Titan) — phishing-resistant, physically separate, survives device loss
- Passkey — phishing-resistant, far more convenient, tied to a platform or password manager
- Authenticator app (TOTP) — offline, immune to SIM swaps, still phishable
- Push notification with number matching — roughly TOTP-equivalent, better UX
- SMS code — vulnerable to SIM swapping, but far better than nothing
- Password alone — one breach away from compromise
What to actually do this week
Add passkeys where offered, starting with your email, Google/Apple/Microsoft account, and password manager. These are the accounts that can reset everything else.
Then remove the weaker fallbacks on those same accounts — particularly SMS. Adding a passkey without closing the back door achieves very little.
Keep your authenticator app for everything that has not caught up. That will be most of your accounts for at least another couple of years. If you are choosing one, our comparison of authenticator apps covers backup and migration, which matter more than the code generation itself.
Save offline backup codes either way. Passkeys do not eliminate lockout risk; they change its shape.
Frequently asked questions
Are passkeys 2FA?
A passkey is usually treated as a complete login — it combines something you have (the device) with something you are or know (biometric or PIN), so it satisfies two-factor requirements on its own. Most sites let a passkey replace both password and code.
Can passkeys be stolen?
The private key cannot be extracted from a properly implemented secure enclave, and it is never sent over the network. The realistic risks are someone unlocking your physical device, or a compromise of the cloud account your passkeys sync through.
Should I delete my authenticator app once I have passkeys?
No. Keep it for the many services that do not support passkeys yet, and as a fallback where a site allows both. Delete it only when every account you hold has moved on.
Do passkeys work offline?
The signing happens locally on your device, so the cryptography works offline — but you still need connectivity to reach the site you are logging into.
What happens if I lose the device holding my passkeys?
If they sync through iCloud Keychain, Google Password Manager, or a password manager, sign in on a new device and they reappear. If they were device-bound only, you must use a backup method or start account recovery.
The bottom line
Passkeys are the better technology and the clear direction of travel. But “better” does not mean “sufficient” while most of the internet still runs on six-digit codes. Use passkeys where you can, keep your authenticator for the rest, and remove SMS fallbacks wherever a service lets you. If you are new to all of this, start with our plain-English guide to two-factor authentication.
3 Responses