The Spare Key Problem: Passkeys, Shared Phones and the UK Login You Cannot Borrow

Passkeys have a simple sales pitch: stop remembering passwords, start signing in with your face, fingerprint or device PIN. In 2026 that pitch is no longer theoretical. UK banks, retailers and public services are offering passkeys as a more secure way to sign in, and the technology behind them is sound. The difficult part is not the cryptography. It is the ordinary household.

A passkey works well when one person uses one phone for one account. It becomes more complicated when a family shares a tablet, when an older relative relies on a carer's handset, when a work phone is replaced at short notice, or when the account in question is a bank, a tax service or a retailer holding payment details. The promise is stronger security. The everyday reality is a question of custody: who holds the key, where is the spare, and how do you get back in when the device is gone?

What a passkey actually stores

A passkey is a cryptographic credential, not a password hidden in your phone. When you create one, your device generates a pair of keys. The public key goes to the service. The private key ordinarily stays on your handset, computer or hardware security key, or inside an encrypted sync service such as iCloud Keychain, Google Password Manager or a similar platform tool. The service never receives a reusable secret that can be copied from a breach.

That design explains the security claim. Because the credential is tied to the website's domain, it is resistant to the fake login pages that harvest passwords. It also removes the temptation to reuse the same password across a bank, an email account and a shopping site. The private key is unlocked locally by a biometric check or device PIN, and the biometric data itself is not sent to the service.

The security gain is real, but the operational gain is conditional

Passkeys reduce one class of risk without removing every risk. A passkey does not abolish the need for a recovery route. Most services still keep a password, an email link, a one-time code or a call-centre process as a fallback. That fallback is where the old weaknesses can return. If the recovery email is insecure, or the registered phone number is stale, the account is only as strong as its weakest route back in.

There is also a practical limitation that providers do not always explain clearly. Passkeys are not yet universally portable between ecosystems. A passkey synced through one platform's account may not move cleanly to another, and some services still support only one passkey at a time. The result is a credential that feels modern but can behave like a key to a door that only one device can open.

Shared devices expose the weak point

A household tablet, a work phone used for personal banking, or a carer's handset used to manage someone else's affairs are all tests that passkeys were not designed around. A passkey enrolled in a shared browser profile is effectively a household key. If the device is handed to a visitor, left on a train or sold without a proper reset, the account is exposed.

The safer pattern is separate user profiles and separate device accounts, not shared logins. Where a carer needs access, the better route is an authorised arrangement with the bank or service, not a passkey stored on someone else's phone. For retailers, the risk is lower but still real: a saved passkey on a family tablet can become a one-tap route to stored payment details.

Recovery deserves the same scrutiny as the login

Before switching a critical account, find out what happens when the device is lost. Does the service allow a second passkey? Can you add a hardware security key? Is there a recovery code, and where should it be kept? Will the bank require a phone call, a branch visit or identity documents? Public services accessed through GOV.UK One Login have their own recovery steps, and they may not match the process used by a retailer.

The uncomfortable truth is that recovery is often the real password. A passkey can be strong, but if the fallback is an old SMS number or an email account protected by a reused password, the overall chain is weaker than it looks.

A UK switching checklist

1. Start with a small number of important accounts, not every login you own.
2. Enrol a second device or a hardware security key where the service allows it.
3. Confirm whether the passkey is synced through a platform account or tied to one device.
4. Set a strong device passcode and keep the device operating system updated.
5. Check that your recovery email and phone number are current.
6. Store any backup codes offline, not in the same account you are protecting.
7. Test sign-in on the second device before you rely on the passkey.
8. Keep passkeys out of shared browser profiles and shared handsets.
9. Remove passkeys and revoke device access before selling or recycling a phone.
10. Do not delete your password until you are confident the recovery route works.

Accessibility is not an afterthought

Biometric checks do not suit everyone. Fingerprints can fail with age, injury or certain health conditions. Face recognition can be difficult for people with limited vision or mobility. A device PIN is a useful fallback, but it depends on the person being able to use and remember it. Hardware security keys can help, but they add cost and another object to manage.

For public services and banks, the obligation is to keep a workable alternative. A passkey should be an option, not a barrier that assumes every customer has a recent smartphone and a stable platform account. The same applies to older users, people with cognitive impairments and anyone who relies on a carer to manage their affairs.

Questions to put to providers

Ask how many passkeys an account can hold. Ask whether the passkey works across different device types. Ask what proof is required for recovery and how long it takes. Ask whether support staff can remove a lost passkey without weakening the account. Ask what happens to the passkey when a device is upgraded, reset or passed on. The answers will tell you more about the practical security than the marketing page does.

The spare key test

Passkeys are a genuine improvement for many UK logins, and they deserve adoption. But they shift the burden from remembering a secret to holding a credential, and that makes device management part of account security. The best setup is not the one with the most passkeys. It is the one you can recover from a lost handset, a new phone or a family emergency without locking yourself out.

Treat a passkey like a spare key: decide where it lives, who can reach it and what happens when it goes missing. That is less exciting than the sales pitch, but it is the question that will decide whether passkeys feel like progress or another password problem in disguise.