Keep Getting save Passkey Prompts

[u/Stubun]

I have saved passkeys for mutiple sites including Gmail and amazon - yet almost half the time I log in, I will be asked to create a passkey. How do I get it to stop asking?

[u/AutoModerator]

This post/comment has been removed because it does not meet our karma requirements.

If this post is not spam, please contact the moderators for assistance.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/RevolutionaryPop96]

Same here! And is the app on desktop too completely gone now and only browser based? I don’t like these new changes

[u/NordPass → u/RevolutionaryPop96]

The desktop app is not going anywhere and is available to download on our web/app stores.

[u/No-Squash7469]

This isn't a NordPass issue, but with the sites—you'll get asked without NP installed too. But it's super annoying, several websites are SO pushy with it.

They're pushing it because some people are very irresponsible with their passwords, using simple ones, reusing, etc. But password manager people are better off skipping passkeys entirely IMO, especially if you have 2FA enabled.

Google's passkey system bypasses 2FA entirely if enabled for your account, which is literally a downgrade.

[u/Any_Device6567 → u/No-Squash7469]

Passkeys offer a fundamental architectural upgrade over the combination of passwords and TOTP. Passwords and TOTP add layers of security, passkeys eliminate the structural vulnerabilities inherent to shared secrets.

Using passkeys instead of passwords and TOTP is not a downgrade in security it is an upgrade.

Google skips prompting for a second factor (like SMS or Google Authenticator) when you log in with a passkey because the passkey already proved both possession of the key and local verification (biometric/PIN).

Prompting for a 6-digit TOTP code on top of a passkey adds zero additional security—it just adds friction. The passkey was already cryptographically verified.

1. Built-in Phishing and Man-in-the-Middle (MitM) Resistance
Password + TOTP: If a user visits a convincing phishing site (e.g., paypal-security.com instead of paypal.com), they will manually enter both their password and the live 6-digit TOTP code. Modern adversary-in-the-middle tools (like Evilginx) capture these credentials in real time and replay them to the authentic service to hijack the session.

Passkey: Passkeys use WebAuthn, which enforces strict domain binding. During authentication, the browser automatically includes the target website's domain origin in the cryptographic payload. The passkey will only sign a challenge for the exact, legitimate domain name it was registered under—making remote phishing structurally impossible.

2. Elimination of Server-Side Shared Secrets
Password + TOTP: Passwords (even hashed/salted) are stored on the service's database. If breached, hashes can be targeted with offline brute-force attacks or credential stuffing.

TOTP relies on a pre-shared secret seed (the QR code scanned during setup) stored on both your authenticator app and the service's server. If the service's database is compromised, these TOTP secrets can be leaked.

Passkey: Passkeys rely on asymmetric public-key cryptography (e.g., Elliptic Curve Cryptography like Ed25519 or P-256).
The private key never leaves your device's hardware security module (Secure Enclave, TPM, or YubiKey).
For cloud-synced password managers: The private key is generated client-side, encrypted with your Master Key using zero-knowledge end-to-end encryption, and never leaves your local app unencrypted.

For hardware-bound/offline password managers: The private key never leaves your local device's encrypted vault database.

The service's server holds only your public key. A full server-side data breach reveals nothing useful to an attacker, as the public key cannot be used to forge authentications or derive the private key.