FYI, passkeys do not require anything in hardware. You can connect them to software only password managers like 1Password or Bitwarden. Where they are nice tho

FYI, passkeys do not require anything in hardware. You can connect them to software only password managers like 1Password or Bitwarden. Where they are nice though is that they are also tied to a specific origin (domain), so a phishing site can't ask for the real passkey. But I've never seen a passkey be a primary source of authentication, so they can always fool the user to falling back to some weaker auth (email reset or 2fa).