Family Sharing and Passkeys: Avoid “One Phone Owns Everything”

Most families have been there. One person’s phone holds every password. The streaming login, the energy account, the kids’ school portal, all sitting in one place, on one device, owned by one person. If that phone gets lost, broken, or just left in a jacket pocket, everyone’s locked out.

Tech moves fast, and keeping up can feel exhausting. New features appear with new names, and suddenly you’re not sure whether “Family Sharing” and “Family Passwords” are the same thing. (They’re not, and that confusion trips up a lot of people.) You want a clear answer, not another article that makes you feel more confused than when you started.

This guide covers how Apple’s Shared Password Groups work, how to keep your family’s accounts safe, and most importantly, how to make sure no single phone ever becomes the only key to everything you share.

The Two Things People Confuse (And Why It Matters)

Family Sharing vs Shared Password Groups

These two features sound like they do the same job. They don’t. Mixing them up is one of the most common reasons people get stuck when trying to set this up.

Family Sharing is Apple’s feature for sharing purchases and subscriptions, things like App Store apps, Apple TV+, and iCloud storage. Shared Password Groups (called “Family Passwords” in iOS 17) is a completely separate feature. It lets you share actual login credentials, usernames, passwords, and passkeys, with specific people you choose.

Family Sharing is about shared access to Apple services. Shared Password Groups is about sharing the logins to outside accounts, your streaming services, utilities, or household apps. The two don’t overlap. You can use Family Sharing without ever touching Shared Password Groups, and vice versa.

Passkeys vs Passwords: What You’re Actually Sharing

You’ve probably seen the word “passkey” appearing more often lately. It sounds like jargon, but the concept is actually straightforward.

A passkey replaces your traditional password entirely. Your device creates a secure key pair, one part stays on your device, one part lives on the website or app. You sign in using Face ID, Touch ID, or your device PIN. There’s no password text to type, remember, or accidentally share with the wrong person.

Both passwords and passkeys can live inside Apple’s Passwords app (or inside Settings on iOS 17). Both can be added to a Shared Password Group. The key difference is that passkeys are much harder for attackers to steal, because nothing sensitive travels across the internet when you sign in.

What Passkeys Are (In Plain English) and Why They’re Safer

Phishing Resistance: Why Passkeys Are Harder to Steal

Phishing is when someone tricks you into typing your password into a fake website. It’s one of the most common ways online accounts get compromised. Passkeys are built to make that kind of attack far harder.

Passkeys use a public-private key pair based on the WebAuthn standard. Your device creates two linked keys, a public one the website stores, and a private one that never leaves your device. There’s no shared secret being transmitted, so there’s nothing to intercept and nothing for a fake website to steal.

Think of a password as a key you hand to someone else for safekeeping. A passkey is more like a lock that only responds to your specific fingerprint, the website never gets a copy of the key itself. If someone builds a fake website to fool you, your device simply won’t authenticate to it.

Where Passkeys Live: iCloud Keychain and End-to-End Encryption

Your passkeys and passwords don’t just sit on one device. They sync across your Apple devices through iCloud Keychain. That sync is end-to-end encrypted, meaning Apple itself cannot read your credentials.

Apple’s iCloud Keychain uses a process called escrow to protect your keychain data. If you lose all your devices and need to recover, Apple can assist, but only after strict identity checks. Your actual credentials stay encrypted throughout the entire process.

This is worth understanding because it’s the foundation of why the system is more secure than storing passwords in a Notes app, a text message, or on a sticky note.

Before You Share Anything: Prerequisites Checklist

Software Versions and Device Compatibility

Shared Password Groups require iOS 17, iPadOS 17, or macOS 14 (Sonoma) or later on every device involved. If anyone in the group is on an older OS version, they won’t be able to join or use the group. This is the most common reason setup quietly fails.

It’s a quick check. Go to Settings, then General, then Software Update. Make sure everyone does this before you start trying to set anything up.

Apple Account Sign-In, iCloud Keychain, and Two-Factor Authentication

Three things need to be active before passkeys will work at all. Skip one, and the setup stops before it starts.

• Signed into your Apple Account on the device
• iCloud Keychain turned on (Settings > [your name] > iCloud > Passwords and Keychain)
• Two-factor authentication (2FA) active on your Apple Account

Two-factor authentication means that when you sign in on a new device, Apple sends a verification code to one of your trusted devices or your trusted phone number. It’s an extra check that stops someone accessing your account even if they get hold of your password. For passkeys, it’s non-negotiable.

The Contacts Requirement: Why Is That Contact Grey?

When you try to add someone to a Shared Password Group, their name appears in blue if they’re eligible to join. It appears in grey if something’s blocking the invite. This usually means they’re not on a compatible OS version, or their Apple Account isn’t linked to the contact details you have saved for them.

Double-check that the contact has an email address or phone number in your Contacts app that matches their Apple Account. Ask them to check their iOS or macOS version too. Sorting those two things resolves the grey contact issue almost every time.

How Shared Password Groups Work (Roles and Rules)

Group Owner vs Group Member: Who Controls What?

Not everyone in a Shared Password Group has the same control. The Group Owner creates the group and can add or remove members, delete the group entirely, and manage which credentials are in it. Group Members can view and use shared credentials and add their own, but they cannot remove other members or delete the group.

This role split matters a lot when life changes. A teenager moving out, a housemate leaving, a relationship ending, the Group Owner handles all of that. If you’re setting up a group for your household, you should almost always be the owner.

What Syncs: Passwords, Passkeys, and Sign in with Apple

When you add a credential to a Shared Password Group, it syncs to every member’s device through iCloud Keychain. This covers standard passwords, passkeys, and Sign in with Apple credentials. If you edit a shared credential, it updates automatically across all members’ devices. No one needs to manually copy anything.

Notifications and Change Syncing Across Devices

Members receive a notification when a credential in the group changes. This keeps everyone informed without requiring anyone to check manually. It also acts as an early warning signal. If a credential changes and you weren’t expecting it, you’ll know straight away.

Step-by-Step: Create a Shared Group (iOS 18 and iOS 17)

iOS 18: Using the Passwords App

Apple introduced a dedicated Passwords app in iOS 18. It’s a standalone app separate from Settings, and it makes managing credentials much cleaner than before.

1. Open the Passwords app on your iPhone or iPad.
2. Look for the New Shared Group option. If you don’t see a card for it, tap the plus (+) icon and select New Shared Group.
3. Give your group a name (for example, “Home” or “Family”).
4. Tap Add People and select contacts from your list. Blue names are ready; grey names need a software or contacts check.
5. Send the invites. Members will receive a notification to accept.
6. Once everyone’s joined, tap Move Passwords to move credentials from your personal vault into the group.

iOS 17: Settings > Passwords > “Family Passwords”

On iOS 17, this feature lives inside the Settings app, not a standalone app. Go to Settings, then Passwords. You should see a “Family Passwords” card near the top of the screen.

1. Tap the Family Passwords card, then tap Get Started.
2. Select Create New Group and name it.
3. Add people from your contacts list and send invites.
4. Move credentials into the group once members have accepted.

Troubleshooting: Card Not Showing?

If the Family Passwords card doesn’t appear in Settings > Passwords on iOS 17, tap the plus (+) icon in the top right corner, then select New Shared Group. The card sometimes doesn’t load on the first visit to the Passwords screen.

What to Share (And What Not to Share)

Safe Family Shares: Streaming, Utilities, Household Services

Streaming services, home broadband accounts, utility portals, and food delivery services are the natural fit for a Shared Password Group. They’re shared household expenses, multiple people genuinely need access, and if a password changes, the whole group gets updated automatically.

High-Risk Shares: Banking, Work, and Admin Accounts

Never put banking credentials, work logins, or admin accounts into a family shared group. These carry serious financial or professional consequences if accessed by the wrong person, even unintentionally. Work SSO (Single Sign-On) logins often grant access to company systems and data that shouldn’t be shared outside your organisation.

For these, set up entirely separate personal accounts. Don’t rely on a shared group to limit access. The safest option is not sharing them at all.

Group Strategy: Think in Categories, Not One Big Group

Apple lets you create multiple Shared Password Groups. Use that. A sensible structure might be one group for a partner, a separate group for kids (with age-appropriate access only), and another for home services. This way, if a housemate moves out, you remove them from the “Home Services” group only, without touching anything else.

The “No Single Phone Owns Everything” Plan

This is the section most guides skip. Setting up a Shared Password Group is step one. Making sure the whole system doesn’t collapse when a device is lost or a member leaves is equally important.

Redundancy Layer 1: Multiple Approved Devices

iCloud Keychain syncs your passwords and passkeys across every Apple device signed into the same Apple Account. If your phone is lost or broken, your credentials are still on your iPad, your Mac, or any other signed-in device. This only works if those devices are set up in advance, not after the fact. Add a secondary device to your Apple Account now, before anything goes wrong.

Redundancy Layer 2: Set Up a Recovery Contact

An account recovery contact is a trusted person who can help you regain access to your Apple Account if you’re ever locked out. They don’t get access to your passwords. They simply receive a recovery code when you need it, after you’ve already verified your identity. Set this up in Settings > [your name] > Sign-In & Security > Account Recovery. Add someone you trust completely. Most people skip this step, and regret it when it matters.

Redundancy Layer 3: iCloud Keychain Recovery

Apple’s iCloud Keychain recovery system uses an escrow process. When you have iCloud Keychain and 2FA enabled, Apple holds a securely encrypted copy of your keychain data. If you lose all your devices at once, you can recover through a trusted phone number and identity verification. Your data stays encrypted throughout. Apple cannot read it, but you can get back in.

Lockout Prevention Checklist:

• Set up iCloud Keychain on at least two devices
• Add a trusted phone number to your Apple Account
• Set a recovery contact in Sign-In & Security settings
• Confirm 2FA is active
• Check that all household members are on iOS 17+ or macOS 14+

Offboarding Safely: Removing People Without Surprises

Removing Someone From a Group

Removing a member from a Shared Password Group stops future syncing to their device. But it does not automatically change the credentials they already had access to. They may still be able to use those logins. After removing someone, change the passwords for every account you own in that group, and revoke any passkeys for sites where you were the credential owner.

Think of it like changing your door lock after giving someone a key. Removing them from the group is like asking for the key back. Rotating your credentials is actually changing the lock. Both steps matter.

Leaving a Group: What Happens to What You Shared?

If you leave a Shared Password Group, the credentials you added to that group may still be visible to remaining members until the Group Owner manages or removes them. Anyone who had access before you left may still have access.

Before leaving a group, check what you added to it. Change those credentials straight away, especially anything financial or personal. Don’t assume that leaving automatically revokes anything.

Deleted Credentials and the 30-Day Recovery Window

Credentials deleted from a Shared Password Group aren’t gone immediately. Apple holds them in a 30-day recovery window. This is useful if something gets deleted by accident. It also means a removed member can’t instantly wipe shared credentials. There’s a window to recover anything important.

Alternatives: When AirDrop Is Better Than a Shared Group

One-Time Sharing via AirDrop

AirDrop lets you send a single password or passkey directly from your device to someone nearby. It’s a one-time transfer, not an ongoing sync. Once the transfer is done, there’s no group to manage and no credentials staying in a shared space. AirDrop requires both devices to be nearby, with Bluetooth and Wi-Fi on, and it works best when the recipient is set to receive from Contacts Only.

AirDrop vs Shared Groups: Which One to Use?

AirDrop transfers a snapshot of the credential at that moment. It doesn’t stay in sync. If a password changes a week later, the person you AirDropped to still has the old one. For accounts that get updated regularly, a Shared Password Group is the right tool.

Safari and Everyday Usage Tips

Passkeys in Safari With Face ID and Touch ID

When you visit a website that supports passkeys in Safari on iPhone, you’ll see a prompt to sign in using Face ID or Touch ID. There’s no password to type. Safari handles the authentication using the passkey stored in iCloud Keychain, and AutoFill Passwords and Passkeys completes the sign-in for you.

This works across Apple’s own services and a growing range of third-party websites. Apple has been working to make Safari increasingly friendly to passkeys, and the experience is noticeably smoother than password-based sign-in for sites that support it.

iOS 18’s Passwords App vs iOS 17: What Actually Changed?

On iOS 17, credential management happens inside Settings. Go to Settings, then Passwords, and you’ll find the Family Passwords card there. On iOS 18, Apple moved everything into a dedicated Passwords app. It’s a standalone app with its own icon, cleaner navigation, and easier access to Shared Groups.

The core feature is identical across both versions. The iOS 18 app is simply easier to find and faster to use day-to-day. If you’re on iOS 17 and everything is working, there’s no urgent reason to update just for this, but the Passwords app in iOS 18 is a meaningful improvement for families who use it regularly.

Mini Glossary

Passkey: A login method that replaces typed passwords. Your device authenticates using Face ID, Touch ID, or a PIN. Nothing sensitive is transmitted over the internet.

iCloud Keychain: Apple’s built-in password manager. Stores and syncs your passwords, passkeys, and payment details securely across your Apple devices.

Shared Password Group: A feature inside the Passwords app (or Settings > Passwords on iOS 17) that lets you share specific credentials with chosen contacts. Also called “Family Passwords” in iOS 17.

Two-Factor Authentication (2FA): A second step when signing in, typically a code sent to a trusted device or phone number, to confirm the sign-in is genuine.

Recovery Contact: A trusted person you nominate who can help you recover your Apple Account if you’re locked out. They don’t access your passwords; they just relay a recovery code.

Group Owner / Group Member: The two roles inside a Shared Password Group. The owner controls the group and its members. Members can view and use shared credentials and add their own.

WebAuthn: The open security standard that passkeys are built on. It’s the technical specification behind public-private key authentication.

Escrow (iCloud Keychain): Apple’s secure backup process for your keychain data. Keeps an encrypted copy safe so you can recover it if you lose all your devices.

FAQs

Can I share passkeys with family members on iPhone?

Yes. You can share passkeys with family members through a Shared Password Group. Both you and the recipient need iOS 17 or later, an Apple Account, iCloud Keychain turned on, and two-factor authentication active. The recipient must also be in your Contacts app. Once the group is set up, passkeys sync to all members’ devices automatically.

Do shared passkeys update automatically on everyone’s devices?

Yes. When you edit a shared password or passkey inside a Shared Password Group, the change syncs to all group members’ devices through iCloud Keychain. Members receive a notification when a credential changes. No one needs to copy or re-enter anything manually.

What’s the difference between Family Sharing and “Family Passwords”?

Family Sharing is Apple’s system for sharing app purchases, Apple subscriptions, and iCloud storage across a family group. “Family Passwords” is the iOS 17 name for Shared Password Groups, a completely separate feature for sharing login credentials to outside accounts. They do different jobs and don’t interact with each other.

Why is a contact grey when I try to add them to a shared group?

A grey contact usually means they’re not running iOS 17, iPadOS 17, or macOS 14 or later, or their Apple Account isn’t linked to the contact details you have saved. Ask them to update their device software and confirm the email or phone number in your Contacts matches their Apple Account.

What happens if I remove someone from a shared password group?

Removing a member stops their device from syncing group updates going forward. But it doesn’t change any credentials they already saw. After removing someone, change the passwords and revoke the passkeys for every account you own in that group. Don’t skip this step if you’re removing someone you no longer trust.

If I leave a shared group, can others still use what I shared?

Yes. Remaining members may still have access to credentials you added to the group. Before leaving, check what you contributed to the group and change those credentials straight away. Leaving doesn’t automatically revoke access to anything you shared while you were a member.

What happens to my passkeys if I lose my iPhone?

Your passkeys are still accessible on any other Apple device signed into the same Apple Account with iCloud Keychain turned on. If you’ve lost all your devices, Apple’s iCloud Keychain recovery system, using a trusted phone number and identity verification, gives you a path back in. Your keychain contents stay encrypted throughout.

Do passkeys require iCloud Keychain and two-factor authentication?

Yes. To create, use, and share passkeys on Apple devices, iCloud Keychain must be turned on and two-factor authentication must be active on your Apple Account. Without both, you won’t be able to set up or use passkeys, or join a Shared Password Group that contains them.

Is sharing passkeys safer than sharing passwords?

Passkeys are generally safer than passwords because there’s no password text to intercept, guess, or steal. They use a public-private key pair based on the WebAuthn standard, which makes them phishing-resistant. Sharing either type carries some risk, but a passkey shared through an end-to-end encrypted Shared Password Group is more secure than texting a password to someone.

Should I use AirDrop or Shared Groups to share a password?

Use AirDrop for a quick, one-time transfer to someone nearby. It’s simple and leaves no ongoing connection. Use a Shared Password Group when multiple people need continued access to the same credential, especially if it changes regularly. AirDrop shares a snapshot; a Shared Group stays in sync.

How do I prevent being locked out of my Apple Account?

Set up an account recovery contact in Settings > [your name] > Sign-In & Security > Account Recovery. Make sure at least one trusted phone number is linked to your Apple Account. Keep iCloud Keychain active on more than one device. Taking all three steps gives you multiple ways back in if something goes wrong.

What’s different in iOS 18’s Passwords app vs iOS 17?

iOS 18 introduced a standalone Passwords app with its own home screen icon, separate from the Settings menu. iOS 17 handled everything inside Settings > Passwords with a “Family Passwords” card. The underlying features are the same, but the iOS 18 Passwords app is easier to access and better organised for managing multiple groups.