What a password manager does
A password manager is a smart safe for shared secrets. Every site still requires a password; the manager generates a strong one, stores it in an encrypted vault, and autofills it into forms. The site continues to store the password (as a hash) on its side. Breaches on either side leak credentials.
What a passkey does
A passkey generates a public/private keypair per relying party. The site stores only the public key. The private key never leaves your device. On login, the site sends a challenge; your device signs it with the private key; the site verifies the signature against the stored public key. There is no shared secret to leak on either side.
What breaks first in each model
Password managers concentrate risk in the master password + vault blob (the LastPass 2022 incident is the textbook example). Passkeys concentrate risk in the device's secure enclave — much harder to breach at scale, but harder to migrate if the device is lost without proper recovery. Password managers also remain vulnerable to phishing autofill on spoofed domains; passkeys are origin-bound cryptographically.
Phishing resistance
Password managers reduce phishing risk (autofill helps distinguish real from spoofed domains) but do not eliminate it. Passkeys eliminate the class: a phishing page cannot produce a valid signature for the real relying party, no matter how convincing the UI.
Post-quantum readiness
Passwords hashed with bcrypt/argon2 today are safe against classical computers. When quantum arrives, offline brute-force against captured vault dumps becomes plausible in reasonable time frames. Passkeys implemented with post-quantum signature schemes (ML-DSA-65 in H33's case) are already quantum-safe.
Where H33 fits
H33 is the identity that owns passkeys, adds guardian recovery so a lost device is not a locked-out account, and continues signing every action after login — not just the initial authentication. Password managers are supplementary for sites that never adopt WebAuthn (a shrinking set).