Apple Keychain vs. Google Password Manager: Where Should You Save Your Passkeys?
Understanding how FIDO2 passkeys work on Apple devices, why your choice of password manager matters, and what happens when you move between Apple, Google, and Windows.
Introduction
I am the developer of AppKeyId, an attested communication platform that uses FIDO2 biometric passkeys to authenticate users and digitally sign communication cards intended for a specific individual — and no one else. Unlike conventional email or messaging systems, AppKeyId allows the sender to establish not only who a communication is intended for, but also who has acknowledged receiving it, using cryptographic authentication rather than conventional passwords.
When someone creates an AppKeyId account using their email address, they are prompted to create and save a synchronized FIDO2 passkey on their device. On an Apple device, this introduces an interesting choice. If the user is running Chrome, they may be offered the option of saving their passkey to either Apple’s iCloud Keychain or Google Password Manager. If they are using Safari, the passkey is normally saved through Apple’s native password management system, without the same choice between Apple and Google. This is the same for all passkeys for any web application running on Chrome on an Apple device.
This raises a surprisingly important question: Where should you save your passkey, and why does it matter?
To understand the implications of that decision, we first need to understand what a passkey actually is.
What Is a FIDO2 Passkey?
FIDO2 passkeys are a relatively new authentication technology designed to replace traditional username-and-password systems. They became widely available across Apple’s iOS and macOS platforms, Google’s Android ecosystem, and Microsoft Windows beginning in 2022–2023, and are increasingly supported by websites and applications.
Unlike a conventional password, which is a shared secret between a user and a server, a passkey uses public-key cryptography. When a passkey is created, two mathematically related cryptographic keys are generated: a public key and a private key.
The public key is registered with the website or service, while the private key remains under the control of the user’s device and its credential management system. When the user subsequently authenticates, the server sends a cryptographic challenge that is signed using the private key. The server verifies that signature using the previously registered public key, establishing that the user possesses the corresponding private key without ever transmitting it.
The private key is protected by the device’s authentication mechanisms. In a typical Apple or Google passkey implementation, the user must authorize its use through Face ID, Touch ID, another biometric mechanism, or a device PIN or passcode. The biometric information itself never leaves the device, and the private key is not disclosed to the website requesting authentication.
This makes passkeys substantially more secure than conventional passwords. They eliminate password reuse, dramatically reduce the risk of credential theft, and are resistant to phishing because authentication is cryptographically bound to the legitimate website’s domain.
If Passkeys Are Better, Why Aren’t We All Using Them?
Despite these advantages, passkey adoption faces a fundamental obstacle: Most people understand passwords, but relatively few understand passkeys.
Passwords have been part of our digital lives for decades. We know what they are, where we enter them, and what to do when we forget them. Passkeys, by contrast, introduce an unfamiliar concept. Users are asked to create a credential they cannot see, cannot memorize, and generally cannot copy or manage like a conventional password.
For users accustomed to typing passwords, this can feel like surrendering control over their own authentication credentials, even though the underlying technology is considerably more secure.
And then, just as users are beginning to understand the concept, they encounter another decision.
Should they save their passkey to Apple Keychain or Google Password Manager?
Both systems support the same underlying FIDO2 authentication standards. Both offer secure storage and synchronization of passkeys across compatible devices. Both can use biometric authentication to authorize access to the private keys.
Yet they operate within different technology ecosystems, with different approaches to synchronization, device compatibility, account recovery, and portability.
For someone who exclusively uses Apple products, the decision may be straightforward. But what about someone who uses an iPhone, a MacBook running Chrome, and a Windows computer at work? Or someone who currently uses Apple devices but may switch to Android in the future?
The choice of where to store a passkey can have consequences that are not immediately obvious when the credential is first created.
And therein lies the problem. We are asking users to adopt a new authentication technology precisely because it is supposed to make their digital lives simpler and more secure. Yet, before they have even created their first passkey, we may be confronting them with a technical decision they are poorly equipped to make.
The purpose of this article is to explain that choice, examine the advantages and disadvantages of Apple Keychain and Google Password Manager, and help users decide where their synchronized passkeys should live.
The Two Homes for Your Passkeys: Apple vs. Google
When I first started working with FIDO2 authentication, there were essentially two approaches to storing cryptographic credentials: hardware security keys and software-based authenticators.
The FIDO2 standards emerged in 2018, and some of the earliest implementations relied on dedicated hardware devices. Companies such as Yubico introduced products like the YubiKey 5 series, which implemented FIDO2 authentication directly in hardware. These devices could be connected to a computer or mobile device through USB or NFC, providing a highly secure means of authentication without requiring the user to remember a password.
The private cryptographic key remained protected within the hardware device and could not ordinarily be extracted. This made hardware security keys particularly attractive for organizations and individuals requiring a high level of authentication security.
The next major development was the widespread adoption of software-based, synchronized passkeys.
Beginning in 2022 and expanding significantly during 2023, Apple, Google, and Microsoft introduced broader support for passkeys across their operating systems and authentication platforms. Instead of requiring a separate hardware security key, users could create passkeys directly on their smartphones, tablets, and computers, using the devices’ built-in security capabilities.
More importantly, these passkeys could be synchronized across multiple devices, eliminating the need to register a separate credential on every device a person owned.
Apple’s Approach: The iCloud Keychain
Initially, the expectation was that each major platform provider would develop its own passkey management system, integrated into its operating system.
In Apple’s ecosystem, the natural choice was iCloud Keychain, the password management infrastructure that Apple had already developed to store usernames, email addresses, passwords, and other credentials associated with websites and cloud services.
Apple extended this infrastructure to support FIDO2 passkeys. Instead of storing a conventional password, the system could now manage a cryptographic credential associated with a particular website or relying party, together with the account information and private key required for authentication.
The advantage was obvious. A passkey created on an iPhone could be synchronized through iCloud Keychain and made available on an iPad or Mac associated with the same Apple Account. Users could authenticate using Face ID, Touch ID, or their device passcode without having to remember or enter a password.
For someone living entirely within the Apple ecosystem, this was an elegant solution.
Imagine someone who uses an iPhone for communication, an iPad for entertainment, and a MacBook for productivity. All three devices share the same Apple Account, and the user’s passkeys are automatically synchronized between them.
There is very little for the user to manage. Everything works within the familiar Apple environment.
The limitation, however, becomes apparent when the user steps outside that ecosystem.
Consider someone who uses an iPhone for personal communication but a Windows computer at work. The passkeys stored in Apple’s iCloud Keychain are not automatically synchronized into the Windows credential store.
That does not mean the user cannot authenticate on Windows. Modern FIDO2 implementations support cross-device authentication, allowing a user to authenticate on a Windows computer using a passkey stored on an iPhone, typically through a QR-code and proximity-based authentication process.
But this is not the same as having the passkey available locally on the Windows computer.
For users who regularly move between Apple and Windows devices, this distinction can become an inconvenience.
Google’s Approach: Google Password Manager
Google approached the problem from a somewhat different perspective.
Rather than concentrating exclusively on a particular family of hardware devices, Google developed its passkey management capabilities around Google Password Manager, its Google Account infrastructure, and the Chrome browser.
Google Password Manager already provided a means of synchronizing conventional passwords across devices using Chrome. Extending that infrastructure to support synchronized passkeys was a natural progression.
The attraction of Google’s approach is its cross-platform orientation.
A person might use an iPhone for personal communication, a MacBook at home, a Windows computer at work, and an Android tablet while traveling. By using Chrome and Google Password Manager on supported platforms, that person can potentially maintain access to the same synchronized passkeys across these different environments.
Get Richard Krueger’s stories in your inbox
Join Medium for free to get updates from this writer.
Unlike Apple’s iCloud Keychain, which is primarily designed around Apple’s own devices, Google Password Manager is intended to operate across multiple operating systems.
There is, however, an important technical qualification. Installing Chrome and signing into a Google Account does not automatically make Google Password Manager passkeys available on every device. Support for creating, storing, and using synchronized passkeys depends on the operating system, browser version, and available credential providers.
For example, Google Password Manager supports synchronized passkeys on Android and supported desktop environments, including Windows and macOS. On iOS, passkey creation and management are more closely integrated with Apple’s operating-system credential-provider framework, and the available options depend on the installed software and configuration.
Nevertheless, Google’s broader cross-platform strategy provides a compelling alternative for people who do not exclusively use Apple products.
So Which One Should You Choose?
The answer depends largely on the collection of devices and operating systems you use in your daily life.
If you primarily use Apple devices and Safari, Apple’s iCloud Keychain is generally the simplest choice. Your passkeys are synchronized across your Apple devices, authentication is tightly integrated with Face ID and Touch ID, and there is little additional configuration required.
If, however, you regularly use Chrome across a combination of Apple, Windows, and Android devices, Google Password Manager may be the more practical solution, provided that synchronized passkey support is available on those devices.
There is also a third consideration: what happens when you use a computer that does not belong to you?
For example, you might need to sign into a website from a shared computer, a hotel business center, or a friend’s laptop. Having your passwords or passkeys synchronized through a Google Account might seem convenient, but signing into your password manager on an untrusted computer introduces security risks of its own.
A better approach is often to use cross-device passkey authentication, allowing you to approve the login using your own trusted smartphone without transferring or synchronizing your private credentials onto the unfamiliar computer.
Ultimately, the choice between Apple Keychain and Google Password Manager is less about which company offers better cryptography and more about which credential management ecosystem best matches the devices you use.
Both systems implement the same fundamental FIDO2 authentication principles. Both can protect private keys and synchronize credentials securely. The differences lie primarily in platform integration, synchronization, portability, and account recovery.
And there is one final consideration that is easy to overlook: You do not necessarily have to choose one or the other.
Many websites allow users to register multiple passkeys for the same account. This means you can create one passkey stored in Apple Keychain and another stored in Google Password Manager, giving yourself access through both ecosystems.
For users who regularly work across multiple platforms, that may be the most flexible solution of all.
A Real-World Example: Creating an AppKeyId Passkey on macOS
Let’s look at a practical example of how passkey creation works using AppKeyId.
When creating a new AppKeyId account on a Mac running macOS with the Google Chrome browser, the user is prompted to create a FIDO2 passkey as part of the registration process.
By default, Chrome typically offers to save the new passkey in Google Password Manager, associating it with the user’s Google Account. This allows the passkey to be synchronized across other supported devices using the same Google Account.
However, this is not the user’s only option. Depending on the Chrome and macOS versions and credential-provider settings, the user may also be able to save the passkey in Apple’s iCloud Keychain instead.
This illustrates an important distinction: although AppKeyId initiates the passkey creation process, the browser and operating system determine which credential storage options are presented to the user. AppKeyId does not control where the private key is stored.
That said, the user can select “Save another way” to save the passkey to Apple’s iCloud Keychain instead.
By selecting “Passkeys” from the AppKeyId user menu, the user can view their registered passkeys, as shown below. In this example, a single passkey has been created and saved to Google Password Manager.
Here is where things get complicated. The passkey saved in Google Password Manager is associated with the user’s Google Account rather than their Apple Account. It is not automatically available in Safari or synchronized through iCloud Keychain across devices sharing the same Apple Account.
Fortunately, AppKeyId allows users to register multiple passkeys. By selecting “Add Passkey”, followed by “Save another way”, and then choosing Apple, the user can create a second passkey stored in Apple’s iCloud Keychain, as shown below.
This gives the user two independent passkeys for the same AppKeyId account, one managed by Google and the other by Apple.
The AppKeyId Passkeys section now displays two registered passkeys: one stored in Google Password Manager and the other in Apple’s iCloud Keychain. With both passkeys registered, the user can now access AppKeyId seamlessly through either Safari or Google Chrome, using the passkey available in each browser.
Conclusion: Choosing Where Your Passkeys Live
Ultimately, on an Apple device running macOS or iOS, there are two major options for storing synchronized FIDO2 passkeys: Apple’s iCloud Keychain and Google Password Manager. Which one makes the most sense depends largely on whether you use Safari or Chrome as your primary browser.
Safari users are typically committed to the Apple ecosystem. For them, saving passkeys to Apple’s iCloud Keychain is the natural choice. Once created, those passkeys are automatically synchronized across their Apple devices sharing the same Apple Account, making authentication largely effortless.
Chrome users, however, have another option. Chrome typically offers to save passkeys to Google Password Manager by default. The advantage is greater cross-platform flexibility, allowing passkeys to synchronize across supported devices using the same Google Account. This can be particularly useful for people who regularly move between macOS, Windows, and Android.
What If Your Passkey Isn’t Available on Your Computer?
Fortunately, FIDO2 provides another solution: cross-device authentication using a QR code.
Suppose you are using a Windows computer but your passkey is stored in Apple’s iCloud Keychain on your iPhone. Since the passkey is not available locally on Windows, you can choose to authenticate using another device.
The website displays a QR code on the computer screen. You scan it using your iPhone, which initiates a secure authentication process between the two devices. The phone and computer typically communicate using Bluetooth to verify that they are physically near each other, while the authentication itself takes place over a secure internet connection.
Your iPhone then prompts you to authorize the passkey using Face ID, Touch ID, or your device passcode. Once approved, the iPhone uses the private key to sign the authentication challenge, allowing the website to verify your identity and complete the login on the Windows computer.
The important point is that your private key never leaves your iPhone. The Windows computer receives the benefit of the authentication without obtaining a copy of the passkey.
This mechanism works across supported browsers and operating systems, providing a practical way to use passkeys even when they are stored in a different ecosystem.
The Bottom Line
Passkeys represent a significant improvement over conventional passwords, offering stronger security and resistance to phishing without requiring users to memorize complicated credentials.
The choice between Apple Keychain and Google Password Manager is primarily one of convenience, synchronization, and device compatibility rather than fundamental cryptographic security.
If you live entirely within Apple’s ecosystem, iCloud Keychain is probably your best choice. If you regularly use Chrome across multiple operating systems, Google Password Manager may offer greater flexibility.
And if you find yourself using a computer that doesn’t have access to your passkeys, your smartphone can serve as a portable authenticator through FIDO2’s QR-code authentication mechanism.
Be My Friend
To connect with me on AppKeyId, simply sign up for an account and scan the QR code below to add me as a contact.
Or you can click this link.
