Before You Switch to Passkeys, Make a Recovery Plan

Start with the question: what if this device disappears?

A few minutes spent checking recovery options can prevent a passkey setup from becoming an account-access surprise.

Before you switch to passkeys, find out how you would get into the account if the phone, tablet, or computer you use today were lost, damaged, or replaced. The answer is not the same for every passkey or service. It depends on where the passkey is stored, whether it can be used on another device, and what other sign-in or recovery methods the service supports.

Think of the plan as account-specific, not as one universal backup. For example, the passkey for an email account might sync through a provider to another device, while a passkey for a different service might be available only on the device where it was created. Even if you can retrieve the passkey, you may still need to follow the service’s own steps to regain access.

You do not have to avoid passkeys to be prepared. The practical goal is to understand the route back in before you rely on a new sign-in method.

Know whether the passkey is synced or device-bound

Where a passkey lives shapes what losing one device means.

A synced passkey is managed by a passkey provider and may be made available on other devices through that provider’s syncing system. For instance, Apple documents that iCloud Keychain can store and sync passkeys along with other saved information. Availability depends on the provider, the devices involved, and their settings; do not assume that every passkey automatically appears everywhere.

A device-bound passkey is tied to a particular authenticator or device rather than being synced in the same way. If that device is unavailable, you may need another enrolled authenticator or the service’s account-recovery process. The FIDO Alliance’s deployment guidance distinguishes these approaches and emphasizes that backup authenticators and recovery options matter, including for people using synced passkeys.

In everyday terms, a synced passkey can make switching to a replacement device easier when the provider and account remain accessible. A device-bound passkey may offer a different security and portability trade-off, but it makes advance planning especially important. Neither label alone tells you exactly how a particular website will handle a lost device.

Check your fallback access before creating a passkey

Confirm the recovery route while you can still sign in normally.

Start with the account itself. Check that its recovery email and phone number are current and that you can access them. A recovery detail that points to an old inbox or a number you no longer use is not a dependable fallback. These details can help with account recovery, but they do not guarantee that a service will restore access; each service sets its own process.

Next, locate the service’s official account-recovery instructions. Look for what it asks you to do if your usual device or sign-in method is unavailable. If the instructions are unclear, check the service’s help center before changing your setup rather than relying on a general passkey tutorial.

Then identify the passkey provider and the device that will hold the credential. Ask yourself whether you can still access the provider if your primary phone is lost. If the service supports another passkey, a security key, or another backup authenticator, consider whether you can set one up and store or use it separately. Availability varies, so do not assume a particular option exists.

Finally, keep your recovery information private and secure. Do not send verification codes or account credentials to someone who contacts you unexpectedly, and do not save sensitive recovery details somewhere that anyone with access to your unlocked device can use.

1. Confirm that your recovery email and phone number are current and accessible.
2. Find the service’s official instructions for recovering an account when a device is unavailable.
3. Identify which provider will store or sync the passkey and how you would access that provider on another device.
4. Check whether the service supports another passkey or backup authenticator, and set it up if appropriate.
5. Keep any remaining sign-in methods until you have verified your plan.

Create the passkey on a device you control

Careful setup starts with choosing the right device and following the service’s instructions.

Use a personal device that you own and control, rather than a shared, borrowed, or public computer. Google specifically advises users to create passkeys only on devices they personally own and use. This matters because a passkey is a sign-in credential associated with the device or provider used during setup.

Follow the instructions for the service where you are adding the passkey. Before confirming, pay attention to the provider or device named in the setup flow. If you do not recognize it, or the option is being created on a device you do not want to use for this account, pause and check the service’s guidance.

Adding a passkey does not necessarily mean replacing every other way to sign in. Google says adding a passkey to a Google Account does not remove existing authentication or recovery factors. That is specific guidance for Google Accounts, not a promise about how every service behaves. Check the account’s own settings before changing or removing other methods.

Review the setup and test your plan

A quick review helps you spot an unfamiliar device or an untested recovery assumption.

After creating a passkey, return to the account’s security settings and review the listed passkeys or sign-in devices. Confirm that the entry matches the device or provider you intended to use. Services organize these settings differently, so look for the account’s current help instructions if you cannot identify an entry.

Now walk through your recovery plan without making risky changes. Can you reach the recovery email or phone? Do you know how to access the passkey provider from another device? Have you found the service’s recovery instructions? If you set up a second authenticator, can you locate it when needed? A plan is only useful if you know where its pieces are.

Avoid testing recovery by deliberately locking yourself out or deleting the only credential you can use. Instead, verify your contact details and review the instructions while you still have normal account access. If you cannot identify a workable route back in, keep your existing methods and contact the service through its official support channel before relying on the passkey alone.

If a device is lost, act from a trusted device

Secure the account first, then follow the service’s process for removing access and recovering credentials.

If a phone or computer with a passkey is lost or stolen, use another trusted device to review the affected account’s security settings as soon as you reasonably can. If the service lets you view and remove passkeys, identify the entry associated with the missing device and follow its instructions. Google’s guidance, for example, explains how to review or remove passkeys and recommends removing one associated with a lost or stolen device; the exact steps apply to Google Accounts, not every service.

If you cannot sign in, use the service’s official recovery process. You may also need to secure the account used by your passkey provider, especially if the missing device could be used to access that account. Follow the provider’s own guidance for a lost device, and use official support links rather than contact details supplied in unsolicited messages.

A passkey may be synced, device-bound, or handled differently by a particular service. So avoid assuming that deleting a passkey from one account removes it everywhere, or that recovering one provider automatically restores access to every service. Check each affected account and provider separately.

Your ready-before-you-switch checklist

Use this short review for each important account, not just once for all your logins.

Different services can offer different passkey and recovery options, so repeat the checks for accounts where losing access would disrupt your work or everyday life. Prioritize accounts that you use to recover other accounts, such as your primary email, and make sure you understand their own recovery routes.

• I know which device or provider will store this passkey.
• I understand whether it is synced or tied to a specific device, as far as the service and provider explain.
• My recovery email and phone number are current and accessible.
• I have found the service’s official recovery instructions.
• I know whether another passkey or backup authenticator is available.
• I have reviewed the account’s listed passkeys and kept other sign-in methods until I understand the consequences of changing them.