The defining feature of passkeys is that they're stored in your password manager, and you can't read them, so you can't be tricked into typing them into the wrong web site.

Most password managers don't even allow you to export/backup the passkeys yourself. (Bitwarden is an exception.)

Instead, password managers support a finicky app-to-app transfer protocol called "Credential Exchange Protocol" (CXP), where you install two password managers at once, and they convey your passwords + passkeys, without ever generating a file that you can read. (And Microsoft's password manager doesn't even support CXP yet. As of today, you can only do it on Android and iOS.)

Many people read that and say, "see, that's why I'm never going to use passkeys! I'm safer managing my own backups, and I'm too smart to be tricked into copying and pasting my password to the wrong site." But they're wrong. You are not too smart to be tricked. Nobody is.

If you use the same cloud-sync password manager everywhere, passkeys just work. If you don't, you'll have to use Credential Exchange Protocol to transfer them, which is a hassle.

It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.

> But they're wrong. You are not too smart to be tricked. Nobody is.

If my password manager is entering my password for me, so how can I be tricked? That's the superpower for passkeys, right? It also applies for plain passwords. Infact, if a login page looks familiar, but my password manager doesn't show any matching credentials, that throws up red flags for me, because I only use my password manager.

> You are not too smart to be tricked. Nobody is.

Maybe, but most websites I really dont care if my account gets hacked. I care way more about being able to login conveniently. Im just as frustrated with seemingly every single website wanting 2fa doing a 2fa check every week or less.

on Android i use keepassDX it support passkeys and their export too

> Many people read that and say, "see, that's why I'm never going to use passkeys! I'm safer managing my own backups, and I'm too smart to be tricked into copying and pasting my password to the wrong site." But they're wrong. You are not too smart to be tricked. Nobody is.

It is not remotely difficult to not fall for phishing attacks. I think I've seen one in my entire life which was actually well crafted such that a person might fall for it even if he was paying attention. One. Everything else is the lowest effort slop where all you need to do is hover over the link to see "this does not in fact go to microsoft.com like it claims".