Wallets without a seed phrase: how passkey wallets work

Holding your own bitcoin or digital dollars has long meant writing down 12 or 24 words, the seed phrase, and keeping them where no one else can find them. People lose the words, photograph them and type them into fake websites. A newer kind of wallet shows no words at all: you open it with your face or your fingerprint, and on a new phone it comes back when you sign in to your Apple or Google account. It runs on passkeys, the technology that’s replacing passwords on websites.

What that removes is real. What it adds is harder to see: your Apple or Google account, and the company behind the wallet, become part of what holds your money.

What a passkey is

A passkey is a pair of keys that your phone or computer creates for one website or app. The site keeps the public key, which isn’t a secret. The private key, the one that actually signs you in, stays on your devices, and the site never learns it. You approve each use with your face, your fingerprint or your device’s PIN.

Passkeys are built on standards from two bodies, the FIDO Alliance and the W3C. Apple, Google and Microsoft committed to support them in May 2022, and by April 2025 more than 15 billion online accounts could use one, according to the FIDO Alliance.

Two things set a passkey apart from a password or a seed phrase:

• It works only with the site it was made for. No other site can use it, so a fake page can’t ask for it. Words or a password can be typed anywhere.
• It’s copied to your other devices. Apple’s iCloud Keychain and Google Password Manager keep passkeys in sync across the devices signed in to your account, end-to-end encrypted, so that neither Apple nor Google can read them.

How a wallet uses one

A passkey can’t simply stand in for a bitcoin key. Passkeys sign on a mathematical curve called P-256; bitcoin accepts only signatures made on another one, secp256k1, and so do ordinary Ethereum accounts. So wallets put passkeys to work in one of two ways.

To lock a key kept elsewhere. The wallet creates an ordinary key for bitcoin or digital dollars, then encrypts it with a secret that only your passkey can produce, through a standard extension called PRF. Without the passkey, the encrypted copy is useless, so it can be stored on the wallet company’s servers or in your own cloud storage. When you pay, you approve with your face, the passkey unlocks the key on your phone, and the wallet signs. This works for bitcoin and dollars alike.

As the key itself. On Ethereum and the networks built like it, a wallet can be a program, a smart contract wallet, whose code decides which signatures move the money, and that code can accept a passkey’s. Checking one used to be expensive: when Arbitrum, one of those networks, proposed a built-in check in April 2024, it estimated the check would cost 99% less. Polygon added such a check in March 2024 and Optimism in July 2024, under a proposal called RIP-7212, and Ethereum itself in December 2025, with an upgrade called Fusaka (EIP-7951). Bitcoin has no such check, so on bitcoin a passkey can lock a key but never be one.

Which of the two your wallet uses, and where its key is kept, decides most of what follows.

What it removes

• Words to lose or have stolen. Nothing to write down means nothing to misplace, leave in a drawer or photograph. In February 2025, Kaspersky found apps in Google Play and Apple’s App Store that searched people’s photos for pictures of recovery phrases and sent them to attackers; the ones on Google Play had been downloaded more than 242,000 times.
• Fake websites. A look-alike page can’t use your passkey, and there are no words for it to ask you to type.
• Starting over on a new phone. Sign in to the same account, and the passkey comes back.

Your account becomes the key

What used to depend on a sheet of paper now depends on your Apple or Google account, and on what it asks for before it hands your passkeys to a new device. That’s more than the password. If you have no old device left, Apple asks for your Apple Account and its password, a code sent by text to your phone number and the passcode of a device you used before, and it allows ten tries before it destroys its copy of your keychain. Google asks for your Password Manager PIN or the screen lock of an Android phone you used before.

That second lock cuts both ways. Without one, the account alone is enough. In August 2023, attackers tricked an employee of Retool, a software company, into handing over a login code, got into the employee’s Google account and, through it, every code the employee’s authenticator app had backed up there. With those, according to Retool, they reached the company’s internal systems and took over the accounts of 27 of its customers, all in crypto.

With a second lock, no one can let you back in if you forget it. In April 2023, explaining why Google hadn’t yet encrypted those backups end to end, one of its product managers said the protection came at the cost of letting users “get locked out of their own data without recovery”. So remember your passcode, keep your phone number, and set up the account’s own recovery before you need it; the guide on losing your phone explains how.

And the company can take the account away:

• In 2021, a father photographed his toddler’s infection for a doctor, at a nurse’s request. Google’s systems flagged the photos, and Google disabled his account, taking with it his email, his contacts, his photos and his phone number. The San Francisco police found that no crime had been committed, and Google still refused to give the account back, The New York Times reported in August 2022.
• In December 2025, Apple disabled a long-time customer’s account, without warning, when he tried to redeem a gift card worth 500 dollars bought from a major retailer; the card had apparently been tampered with before he got it, according to heise. For days he couldn’t reach his iCloud data, his app purchases or iMessage, until Apple restored the account.

Neither case involved a wallet. Both show what a key kept only in an account depends on: the company’s decisions about that account.

A thief needs your account, or your phone

Because a passkey follows the account to every device, whoever takes over the account takes the passkey too, as the security firm CertiK pointed out in June 2026. One way to get both the account and its second lock is to take your phone and its passcode: with them, a thief can use your passkeys and change your account’s password before you can. The guide on losing your phone has the cases. On an iPhone, Stolen Device Protection asks for Face ID or Touch ID, with no passcode fallback, before passkeys can be used away from familiar places. On Android, Identity Check does the same on the phones that support it. Both have to be turned on.

A passkey’s protection against fake websites has a limit. It tells the real site from a fake one; it can’t tell whether the real one has been tampered with. If someone plants code in the wallet’s own site or app, the request comes from the right place, and the passkey signs what it’s given. That’s how Bybit lost about 1.46 billion dollars in February 2025, according to Elliptic: code planted through a developer’s computer at the company whose app Bybit used to sign showed its signers a routine transfer, and what they approved was something else. They used hardware wallets, not passkeys, but the lesson carries over: a passkey confirms where a request comes from, not what it does.

When you die

A passkey doesn’t pass to your heirs with the rest of your account. Apple lets you name a Legacy Contact who, after your death, can reach your photos, messages and files, but not, in Apple’s words, “data stored in your iCloud Keychain (payment information, passwords, and passkeys)”. Google says it can’t provide passwords or other login details from a deceased person’s account. A wallet whose only key is a passkey in your account can die with you, unless you’ve given your heirs another way in. The guide on inheritance goes through the options.

If the wallet’s company disappears

A passkey works only with the website or app it was made for, which here is the wallet’s own. If the company closes and its site goes with it, nothing else can ask your passkey to sign, or to unlock your key. So before you put money in, find out how you’d move it without the company: whether you can export the key, whether there’s a second key you hold yourself, and where the locked copy of your key is kept. If it’s only on the company’s servers, it goes with them.

Still one key

For all that’s new, a passkey wallet is still a single key, with your account behind it: a single point of failure. The risk has moved from a sheet of paper to an account, a phone and a company; it hasn’t gone. Lose the account and every way back into it, and the money stays where it is, out of reach. Let someone take over the account, or your unlocked phone, and they can move it as easily as you.

Side by side

	Wallet with a seed phrase	Passkey that locks a stored key	Passkey that signs (smart contract wallet)
What you back up	The words	Nothing: your Apple or Google account carries the passkey	Nothing: your Apple or Google account carries the passkey
Enough to steal it	The words, or the unlocked phone	The account and what it asks of a new device, or the phone and its passcode	The same
Enough to lose it	The phone, if the words are lost too	The account, with no way back in, or the locked copy of the key	The account, with no way back in, unless the wallet has another signer
A fake website	Can trick you into typing the words	Can’t use the passkey	Can’t use the passkey
Bitcoin	Yes	Yes	No
If the wallet’s company disappears	Any wallet that follows the standard rebuilds the key from the words	Depends on where the locked key is kept and whether you can export it	Depends on whether the wallet has another way in
When you die	Whoever finds the words has the money	Apple and Google don’t hand passkeys to heirs	The same

What to do

• For everyday money, a passkey wallet is a good fit. It takes away the words and the fake websites. Keep in it about what you’d carry in cash.
• Guard the account as you would the money. A passcode only you know, never typed where someone can watch; theft protection turned on; the account’s recovery set up. The guide on losing your phone goes through each step.
• Before you put money in, ask three things. Is the passkey the key, or does it lock one, and where is that one kept? If the company closed tomorrow, how would you move the money? Can you export the key?
• Leave your heirs a way in. Write down that the wallet exists and how to reach it, without the secrets, because Apple and Google won’t hand them your passkeys.
• For savings, one key behind one account isn’t enough: keep them where no single key or company can lose or move them, in collaborative custody that passes the test in the guide on hardware wallets, multisig and collaborative custody.