Google, Microsoft, Amazon, and PayPal now prompt users to create passkeys. They’re faster than passwords and harder to steal through phishing.
Passkeys can be awkward when you manage multiple accounts or share logins with a team. Which account does each passkey belong to? Can teammates use it? What if your laptop dies?
This guide explains how passkeys work and where they’re stored, then shows how Incogniton gives each browser profile its own passkey store. Open a profile, and you’ll see only the passkeys for its accounts.
TL;DR
- A passkey replaces your password with a key pair, so you sign in with your fingerprint, face, or PIN, and there's nothing for a phishing page to steal.
- Your passkeys normally sit in one store tied to you, such as your device, iCloud, or Google account. When you manage several accounts on one site, that means a mixed-up login list and logins you can't easily share.
- Incogniton gives every browser profile its own passkey store. Each profile shows only its own account's passkey, and cloud saving carries it to teammates and other computers.
- Anyone who can open a profile can use its passkeys, so give each account a backup way in and share profiles only with people who need them.
Passkeys in Plain Language
A passkey is a login credential that replaces your password. You sign in with your fingerprint, face, or device PIN instead of typing anything, and there's nothing for an attacker to phish or reuse. Behind that, a passkey is a pair of cryptographic keys your device creates for one account on one website. Passkeys are built on open standards (WebAuthn and FIDO2), so they work across all major browsers and operating systems.
How the Public and Private Keys Work
Every passkey is made of two keys that only work as a pair. Your device creates both the moment you set one up:
- A private key, which stays with you, on your device or in your password manager.
- A public key, which the website stores with your account.
When you log in, the site sends your device a random challenge. You unlock the passkey with your fingerprint, face, or device PIN, and your device signs the challenge with the private key. The site checks the signature against the public key. If they match, you're in.
Your private key never leaves your device, and your fingerprint or face scan never reaches the website. The scan only unlocks the key locally.
Nothing secret ever crosses the network, and that single fact removes the three weaknesses that make passwords risky:
- Nothing to phish. A passkey only works on the domain it was created for, so a fake login page can't trigger it.
- Nothing worth stealing from the site. A database breach exposes only public keys, which can't log anyone in.
- Nothing to reuse. Every account gets its own key pair, so one leak can't spread to your other accounts.
Compared With Passwords and 2FA
Set side by side with the login methods you already use, the gap is easy to see:
| Password | Password + 2FA | Passkey | |
|---|---|---|---|
| What you do at login | Type it | Type it, then enter a code | Unlock with fingerprint, face or PIN |
| Secret sent to the site | Yes | Yes, plus a one-time code | No |
| Can be phished | Yes | Yes, codes can be relayed to a fake site | No |
| Exposed in a site breach | Yes (hashed) | The password part | Only public keys, which are useless alone |
All of that protection depends on the private key staying somewhere safe, and where it stays matters more than it looks.
Where a Passkey Normally Lives
Every passkey needs a home that keeps the private key under your control. That home is called an authenticator, and the one you use decides who can reach your passkeys and from which devices. Most authenticators fall into one of three groups.
Operating System Authenticators
Your computer or phone can store passkeys itself. On Windows, Windows Hello keeps them on the PC and unlocks them with your face, fingerprint, or PIN. On Apple devices, Touch ID or Face ID unlocks passkeys saved to iCloud Keychain. On Android, your screen lock does the same job. It's the most seamless option. For multi-account work, it's also the least forgiving, because every passkey goes into the same store on that device, whichever account it belongs to.
Synced Cloud Providers
Synced providers save your passkeys to a cloud account so they follow you from device to device. Apple's iCloud Keychain and Google Password Manager are the most common, and password managers like 1Password and Bitwarden work the same way. The convenience comes from tying every passkey to one personal account, which is yours alone.
Hardware Security Keys
A hardware key, such as a YubiKey, stores passkeys on a physical device you plug in or tap. The private key can't be copied off it, which makes it the strictest option. It's also the hardest to live with. Forget the key at home, and you can't log in, and two people can't hold it at once.
All three share one trait. They collect every passkey you own in one place tied to you, not to the account each passkey logs into. Whichever browser window you open, that one shared store decides which passkeys to offer. With one account per site, you never notice. With several, you do.
Why Passkeys Get Awkward With Multiple Accounts
A shared store suits one person with one account per site. Run several accounts on the same platform, or share them with a team, and it starts costing you time and sometimes access. Here are the four ways that show up.
Every Saved Login Shows Up at Once
When a site asks for a passkey, the shared store offers every passkey it holds for that site. With five client accounts on the same platform, you get five options in one list, often labelled only by an email address. Pick the wrong one, and two accounts you meant to keep apart have now logged in from the same browser.
Sharing With a Teammate Is Hard
Everything in that store is tied to you. A synced passkey lives in your personal iCloud or Google account, and a device-bound one lives on your computer. To give a colleague access, you either share part of your personal password manager or register a separate passkey on their device, and both options get messy as accounts and teammates pile up.
A Lost Device Means Lost Logins
A device-bound passkey exists only on the hardware that created it. If that laptop is lost, wiped or replaced, the passkey goes with it, and you're left with whatever recovery option the account has. Synced passkeys survive this, but only because they live in your personal cloud account, which brings you straight back to the sharing problem.
Some Sites Switch You Over by Default
More platforms now offer to create a passkey right after you log in, and some make it the default sign-in method. Accept that prompt in a regular browser, and the new passkey lands in the shared store with everything else, adding one more name to the list from the first problem.
None of this is a reason to avoid passkeys. It's a reason to store them where you already keep accounts apart.
How Incogniton Handles Passkeys
In Incogniton, the place you already keep accounts apart is the browser profile. Each profile has its own fingerprint, cookies and proxy, so an account in one profile never sees what happens in another. Passkeys now follow the same rule, and that answers each problem above:
- Each profile keeps its own store. A passkey you create inside a profile is saved to that profile, not a shared store. When a site asks for one, the profile offers only the passkeys it holds, so you see one account instead of the wrong-login list from earlier.
- No iCloud, Google account, or hardware key needed. The store is part of the profile, so there's nothing to sign in to or plug in. That also makes default passkey prompts safe to accept, since the new passkey stays with the profile that created it.
- Logins stay after a restart. Passkeys are saved with the profile, just like its cookies. Close it tonight, reopen it tomorrow, and you log in the same way.
- Cloud sync carries them with the profile. With cloud saving turned on, passkeys sync with the rest of the profile, to a teammate you share it with or to a second computer. That fixes the sharing and lost-device problems together, and neither depends on anyone's personal cloud account.
Encrypted, but Not Locked to One Device
Incogniton encrypts the file that holds a profile's passkeys. The key inside is built to move with the profile, not to stay locked to one device the way a hardware key does. That portability is exactly what lets passkeys reach your teammates, and it also means anyone who can open the profile can use them. Back up and protect a profile the way you would its cookies.
How to Set Up a Passkey in an Incogniton Profile
Before you add a passkey to a real account, watch the setup work on a test one. A site such as webauthn.io lets you register and use a passkey without signing up for anything. The six steps below take a few minutes.
- Update the profile's browser version. Passkeys rely on the browser's built-in passkey support, so the profile needs a recent browser version. If the profile shows a browser version warning, update it first.
- Open the profile you want to use, or create a new one.
- Register a test passkey. Go to webauthn.io, enter any username and click Register, then accept the passkey prompt.
- Log in with it. Click Authenticate on the same page. You're signed in without a password.
- Restart the profile. Close and reopen it, then authenticate again. This confirms the passkey was saved with the profile.
- Check cloud sync (optional). With cloud saving on, open the same profile on a second computer and authenticate there. This confirms the passkey travels with the profile.
When the test works, add passkeys to your real accounts the same way. Before you rely on one, give each account a second way in, such as a 2FA app or recovery codes. The next section explains why that matters.
Best Practices for Passkeys in Shared Profiles
Whoever can open a profile can use its passkeys. That's the trade-off for passkeys that travel with the profile, and the four habits below keep it working in your favour.
- Keep a second recovery path. Set up a 2FA app or save recovery codes for every account that uses a passkey. If the profile is ever deleted, that recovery path is how you get back into the account.
- Treat profile access as account access. Sharing a profile now means sharing the logins inside it. Use team permissions to give profiles only to the people who need them, and remove access as soon as someone leaves.
- Keep profiles on computers you control. A profile opened on a shared or public machine carries its passkeys there too, so don't open or copy profiles on computers you don't trust.
- Turn on 2FA for your Incogniton account. Your Incogniton login now guards every passkey in your profiles, so it deserves the strongest protection you have. Two-factor authentication is available on every plan.
Conclusion
Passkeys fix the weakest part of logging in, but their default home assumes one person with one account per site. Moving that home into the browser profile removes the assumption. The right account comes up every time, teammates get access through the profile you already share, and nothing lands in anyone's personal iCloud or Google account.
Start free with 10 profiles for 2 months → Test a passkey in a new profile today, no credit card required.
