Apple, Google, Microsoft, Mozilla, and 1Password don’t let you export passkeys to a file that you can read and backup, but Bitwarden, Proton Pass, and KeepassXC do.

I think Bitwarden is on HN's current happy list. (I just use Apple iCloud myself.)

Allowing passkeys to be exported to a plaintext file undermines the phishing protections, at least somewhat. It’s possible to trick you into exporting your passkeys from Bitwarden and sending the file to an attacker.

The major password managers say that this is the reason they don’t allow exporting passkeys, and it’s not false, but they’re also making it harder to switch password managers, which may be their ulterior motive. (You can’t even import those exported passkey files into any of the major password managers, which they would be incentivized to do, if those smaller players had significant marketshare.)

It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.

I’ve relied on iCloud as well, but just learned that it allows apps to store persistent data. This data is synced between all devices, and there’s no way for you to view or manage/delete it. Even determining which apps do this requires you to enumerate the apps entitlements, which is nontrivial. And so an app you install on your iPhone can have configuration or credentials persist to each iCloud-connected device, and you have no control over it. This is certainly convenient, if that’s the behavior you want; if not, there’s no visibility or control.