You Can Finally Move Passkeys Between Managers. Don’t Cheer Yet.

You made it. You finally switched from one password manager to another without crying.

For years, passkeys were sold as the escape hatch from the password era. No more reused passwords. No more phishing bait. No more Big Tech holding your digital identity hostage. Then you tried to leave Google’s or Apple’s garden and found the door locked.

That just changed. You can now move passkeys between password managers. It’s a win. It’s also exactly the kind of win that should make your stomach drop.

Here’s what happened: the industry finally standardized passkey portability. You can export your passkeys from one manager and import them into another. Feels like a damn revolution. One commenter on the news pointed out it’s basically \”documented PKCS12\” — an old format. Another hoped they could stop worrying about where they store passkeys and focus on \”syncing my Bitwarden states properly.\” That second person might not realize how close to the edge they’re standing.

The security promise of passkeys was always hardware-bound isolation. The private key stays on your device. It doesn’t move. That’s why phishing attacks fail. That’s why stolen server databases are meaningless. But portability means the private key has to move. It gets exported, imported, synced, copied, filed. The moment you accept portability, you accept a different security model.

This is the paradox we keep refusing to confront: Passkeys become useful when they’re portable, and become dangerous when they’re portable. The convenience is the vulnerability.

When you make passkeys portable, you are essentially recreating the password manager model — but with cryptographic keys instead of readable passwords. It is a stronger lock, but the same glass house.

Don’t mistake this for a cowardly \”balance\” column. This portability move is correct. We should be able to leave the ecosystems we’re renting. But anyone who says this comes without risk is selling you a story. We didn’t escape the password-manager vulnerability model. We upgraded it to a theft-worthy cryptographic one.

Here’s what you own now: your identity, yes, but also an enormous, synchronized pile of private keys. Attackers no longer need your device. They need your cloud sync token, your master password, or a compromised export file. A password manager full of passwords was bad enough. A password manager full of private keys is a fort with a four-lane highway leading to it.

So what’s the practical move? If you’re going to take advantage of portability, manage it like a vault — because that’s exactly what it is. Use a master password that would survive a John Wick interrogation. Turn on hardware-based 2FA. Export passkeys only to an encrypted local file, then delete it. Do not keep transiting passkeys over the internet just because you can.

The uncomfortable truth is that we’re all now acting as our own security infrastructure. The \”good old days\” of typing a password into the same site over and over were terrible — but at least the secret was static and physically in your head. Now you’re carrying an encrypted treasure chest in your pocket, and the industry just handed you a better shovel to bury it with.

The hardware-bound ideal isn’t dead. It just isn’t available to you unless you’re willing to be locked in. The moment you choose portability, you choose the cloud. You can own your identity, or you can enjoy seamless sync. Right now, you can’t have both without accepting that your identity is only as safe as the sync chain it travels through.

Passkeys were never just about convenience. They were about escape. But every escape route has a toll booth.