If you've turned on passkeys for your Google account, you've probably heard the pitch: no password to type, nothing to phish, nothing sitting in a database waiting to leak. That pitch is largely true. But researchers have now described a technique — nicknamed "Pass-ta-key" — that shows malware on your own device can still get at passkeys stored in Google Password Manager. It's worth understanding exactly what that does and doesn't mean, because the fix is not "stop using passkeys."

A quick refresher on how passkeys actually work

A passkey is a key pair, not a secret you type. The private half is supposed to never leave your device; the site or app only ever sees the public half and a signature proving you hold the private key. That's what makes passkeys resistant to classic phishing — there's no password or one-time code for a fake login page to steal, because the private key isn't something you can be tricked into typing anywhere.

The wrinkle is the word "synced." To let a passkey work across your phone, laptop, and tablet, Google Password Manager encrypts and syncs your passkeys through your Google account instead of locking each one to a single physical device. That convenience is also a bigger attack surface than a passkey that's physically bound to one security key or one device.

What the Pass-ta-key research actually points at

According to reporting on this research (via Malwarebytes), the finding is that malware running on a device where Google Password Manager is unlocked can hijack passkey-protected accounts — not by breaking the underlying public-key cryptography, but by abusing the software layer that stores, unlocks, and syncs the keys. In other words: the math behind passkeys hasn't been cracked. What's being targeted is everything around the math — the local vault, the unlock flow, the sync channel.

The precise technical mechanics of the exploit chain weren't fully detailed in what's public so far, so it's worth being careful not to overstate this into "passkeys are broken." What is clear, and consistent with how these things usually work, is the general shape of the risk: if malware achieves a high enough level of access on a device that has an unlocked passkey store, it can potentially act as you within that store, or export material that lets an attacker authenticate as you elsewhere.

Why this doesn't undo the case for passkeys

It's tempting to read a headline like this as "passkeys failed." They didn't — they closed off a specific, extremely common attack: remote phishing, where an attacker anywhere in the world tricks you into typing a password or one-time code into a fake site. That attack is still dead against a real passkey. What Pass-ta-key illustrates is a different, older threat model: an attacker who already has code running on your device. That threat has always existed, and it was arguably worse for passwords — a keylogger or infostealer on an infected machine could grab a typed password and a session cookie just as easily. Passkeys narrow the attack surface; they don't eliminate the category "your device is compromised."

What to actually check and do

A few concrete, checkable steps, roughly in order of impact:

  • Know which of your passkeys are synced vs. device-bound. In Google Password Manager (passwords.google.com, under "Passkeys"), you can see what's stored and synced to your account. A passkey created and confirmed with a physical security key (like a YubiKey) that you did not sync is bound to that hardware and isn't exposed to this class of attack the same way.
  • For your highest-value accounts — primary email, bank, work single sign-on — prefer a hardware security key over a synced passkey. It's slightly less convenient (you need the physical key), but it never touches cloud sync at all, which removes this entire attack surface for that account.
  • Keep the device itself clean, since that's the actual battleground now. Install OS and browser updates promptly, avoid installing apps or extensions from outside official stores, and don't ignore antivirus/endpoint alerts — a malware infection is the precondition for this kind of attack, so device hygiene does double duty.
  • Turn on Google's Advanced Protection Program if you're a plausible target (journalists, activists, executives, admins, or anyone who's been targeted before). It tightens account recovery and sign-in rules specifically against this kind of account-takeover scenario.
  • Periodically review your Google account's "Recent security activity" and connected devices and remove anything you don't recognize or no longer use — including old synced passkeys sitting on devices you've since replaced.
  • Don't drop your backup authentication method. Keep a recovery method (backup codes, a second passkey on a different device type) that isn't dependent on the same device, so you're not locked out if you do have to wipe an infected machine.

The short version: passkeys still beat passwords, and "unphishable" is still an accurate word for what they do against remote phishing. Pass-ta-key is a reminder that "unphishable" was never the same claim as "immune to a compromised device" — and your defense against the second one is the boring stuff: patch your devices, watch for malware, and put your most important accounts behind hardware-bound keys rather than synced ones.