​

I Never Noticed These Passkey Options Until OS 26

​

Summary

Passkey options in iOS and macOS, introduced in 2022, allow for automatic login upgrades and are synced across devices via iCloud Keychain. While convenient, this raises concerns about device loss and recovery, especially for users without iCloud backup. Websites supporting passkeys are expected to provide recovery options, such as re-enrollment through email, phone, or security questions.

​

​

I’m probably not the only one

SECURITY

These two options have been in Settings->Passwords since iOS 17 and have been turned on by default, but I never knew that. I’m probably not the only one because how often would we be looking in Settings at the Password app?

When I first noticed them, I was unclear on how they work together. After doing some reading here and there, I think this is how it all works:

You might see a message in the Passwords app if you haven’t logged into a site since it added passkey support, which Apple introduced in October 2022 with iOS 16 and macOS Ventura.

You might also see a prompt from the Passwords app or the website itself when logging into a site that recently began supporting passkeys.

Otherwise, if both “Allow Contacting Websites” and “Allow Automatic Passkey Upgrades” are turned on, iOS or macOS may upgrade your login to a passkey automatically or with minimal prompting, depending on how the website implements passkey registration and how recently you’ve logged in.

Help me buy a coffee. Or a Vision Pro? If you enjoy my posts, please consider making a contribution, recurring or not. Thank you. https://ko-fi.com/pcunix​

Apple doesn’t upgrade all passkeys silently — sometimes you have to log in again for the upgrade to occur. Also, some websites require user interaction or display their own passkey upgrade prompt, regardless of Apple’s settings.

Confused? That’s why both of these are on by default: Apple is trying to make it as easy as possible for you to switch to passkeys. Note: some sites might not allow password logins after enabling passkeys. That actually gives you more security, but could be extremely annoying if you only have one Apple device, lose it, and do not have an iCloud backup.

Here’s the details on all that:

Passkey syncing

If you’re in the Apple ecosystem, passkeys are stored in iCloud Keychain with end-to-end encryption and are automatically synced across all your Apple devices signed into the same Apple ID. If you lose one device, your passkeys should still be accessible on others and when you replace the lost one, it will get the iCloud passkey. You will have zero problems.

But, if you only own one device and lose it, that’s where things could get messy, though if you use iCloud backup, you are still okay:

Device-based Recovery

If you get a new iPhone, you restore from iCloud backup. During setup, iCloud Keychain and your passkeys are restored, assuming you’ve enabled two-factor authentication and device verification.

No iCloud backup

Websites that support passkeys are expected to provide recovery or re-registration options. Of course, no law says they have to. Let’s assume they will provide something:

Alternative Sign-in or Re-verification

The site might let you re-enroll a new passkey by verifying identity through email, phone, or security questions. Or they might have offered you a recovery code or backup method when you first enrolled. Failing that, they might let you upload a photo ID to prove who you are.

They might allow you to register a second passkey (e.g. on another device) as a backup or use a platform-agnostic recovery method, like FIDO2 security keys or email-based re-authentication.