A researcher recently described a "Pass-ta-key" attack capable of extracting all passkeys stored in Google Password Manager on a malware-infected Windows machine, prompting concern that passkeys might not be as secure as claimed. However, the technique is neither novel nor unique to passkeys, and the confusion stems from a widespread misconception about how passkeys are actually stored, rather than a genuine new flaw in the technology.

Contrary to popular belief, FIDO2 specifications do not require passkeys to be kept in dedicated secure hardware such as a trusted platform module (TPM); in practice, only Microsoft offers TPM storage, mainly for enterprise users, while all other platforms store passkeys locally to allow syncing across devices. This is generally considered safe because strict app permissions on macOS, iOS and Android prevent malware from reaching stored keys without an OS-level exploit. Windows is the exception, since its apps typically run with full user privileges and its sandboxing only blocks access in one direction, leaving locally stored passkeys more exposed to malware on that platform specifically.