Passkeys Explained: How to Set Them Up and What Happens If You Lose Your Phone

Passwords get reused, guessed and phished. Text-message codes get intercepted or SIM-swapped. Passkeys let you sign in with your phone or computer instead, unlocked by your fingerprint, face or PIN. They’re supported by the major platforms, browsers and password managers, and by a growing list of websites.

The part most guides skip is the one in the title. What still has to work when your phone is gone? Most of this article is about that.

What a passkey actually is

When you create a passkey for a site, your device generates a key pair:

• The private key stays with you, in your device or your passkey provider, and is unlocked by your fingerprint, face or PIN.
• The public key goes to the website.

To sign in, the site sends a challenge, your device signs it after you unlock it, and the site checks the signature with the public key.

The website stores only the public key. Stealing it doesn’t let an attacker sign in as you. Passkeys don’t protect everything else, though: a breached site can still leak your personal data, and attackers can still target password fallbacks, account recovery or a session that’s already signed in.

Why they’re better

• Phishing-resistant: the passkey only works on the real domain it was created for.
• Nothing to reuse or remember: each site gets its own key pair.
• No codes to intercept: no SMS, and no six-digit codes to type into a fake page.
• Faster: one fingerprint or face scan.

A passkey replaces the sign-in flow, but adding one usually doesn’t remove the old ways in. Google says creating a passkey “doesn’t change or remove” the sign-in and recovery methods already on your account.

Where your passkey is saved (check this when you create it)

What matters is where the passkey is saved, not which operating system shows the prompt:

• Synced passkeys are saved in a provider that syncs them across your devices, such as iCloud Keychain (Apple’s Passwords app), Google Password Manager, or a compatible third-party password manager.
• Device-bound passkeys stay on one authenticator, such as a hardware security key or a computer’s built-in authenticator. On Windows, Windows Hello creates device-bound passkeys on that PC unless you save the passkey to a syncing provider instead.

Creating a passkey on a computer doesn’t by itself mean it’s backed up. When the save prompt appears, look at where it’s going.

What happens if you lose your phone

A synced passkey survives a lost phone only if you can sign in to the provider and unlock its encrypted passkey storage from another device. Those are two separate requirements, and they differ by provider: some ask for your account password plus a code sent to a trusted device, a device passcode, or a recovery key. Check your provider’s recovery requirements now, and make sure you can meet them without the phone you might lose.

Keep at least one recovery route outside the provider you’re trying to recover. Recovery codes stored only inside a locked password manager can’t help you unlock that same password manager.

Two ways in that don’t share a weak spot

For important accounts, set up two access routes that don’t both depend on the same phone or the same provider login:

• A second synced device (a laptop or tablet) protects you if one device breaks. It doesn’t help if you can’t get into the provider account itself, because both devices depend on it.
• An independently registered security key, or offline recovery codes where the service offers them, can be a route that doesn’t depend on the phone or the sync provider.

Test the complete sign-in, including any password or PIN it asks for. Owning a key doesn’t prove you can get in.

Do you still need a hardware security key?

For most people’s everyday accounts, no: synced passkeys already resist phishing. A key earns its place in three cases:

• The accounts that unlock everything else: your Apple, Google or Microsoft account, your main email and your password manager. A key can be a route in that doesn’t depend on your phone.
• Higher-risk people: journalists, admins, anyone likely to be targeted. Google’s Advanced Protection Program can be enrolled with a passkey or a FIDO security key.
• When all your synced devices could be lost together, such as in a fire, a theft or a move.

A key’s role depends on the service. It may hold a passkey, or it may act as a second factor alongside your password. Apple’s Security Keys for Apple Account replace the verification code: you still need your Apple Account password, plus a key or a trusted device. Apple requires at least two keys, and warns that losing all your trusted devices and keys can lock you out permanently. Write down what each important account actually needs.

If you use keys, buy two, register both, and keep one away from home.

Test your backup before you need it

Do this once for each important account. Keep a signed-in session open while you test, and never delete your last working credential or sign out everywhere to “simulate” a disaster.

1. Confirm which provider or device holds the passkey.
2. Sign in from a separate browser profile or another device, and confirm the passkey itself works, not just an existing session.
3. With your usual phone out of reach, test your second route: the security key, the other device or the recovery codes.
4. If you used a one-time recovery code, mark it used and generate a fresh set as the service instructs.

If your phone is stolen

A broken phone is an availability problem. A stolen phone can also be an access problem.

• From a trusted device, use the platform’s lost-device controls (Find My, Find My Device).
• Review the account’s active sessions and devices, and follow your provider’s steps to remove the stolen phone’s access.
• If someone may know the phone’s unlock code, treat it as higher risk: change the provider password and review recovery settings.

Removing a passkey and ending a signed-in session are different actions. Do both where needed. Before deleting a synced passkey, check whether deleting it removes it from your other devices too.

Setting one up

1. Sign in to the account the usual way.
2. Find Security (or “Sign-in options”) and choose Create a passkey / Add a passkey.
3. Approve with your fingerprint, face or PIN, and check where it’s saved.
4. Sign out of a separate browser profile and sign back in with the passkey to confirm it works.

Start with the accounts that unlock everything else: your email and your password manager or platform account (Apple, Google, Microsoft).

Sharing with family (short version)

• Apple: the Passwords app can share passwords and passkeys with a group (iOS 17, iPadOS 17, macOS 14 or later for everyone). On a Mac, choose File → New Shared Group. Only the group’s creator can add or remove people.
• Password managers: some offer shared vaults that can hold passkeys. Check your manager’s own documentation.
• When someone leaves, remove the passkey on the website and create a new one. For a password, change it.

Checklist

1. Turn on passkeys for your email and main platform account first, and check where each one is saved.
2. Write down what each important account needs to recover: provider login, unlock requirements, recovery codes.
3. Keep a recovery route outside the provider: offline codes or a security key.
4. Keep the password and recovery email/phone strong and current. They’re still a way in.
5. Rehearse the backup route safely (above).
6. Ask yourself: can I sign in without this phone, and have I tested that?

Sources

• What passkeys are and how they work: FIDO Alliance, passkeys.dev, W3C WebAuthn
• Windows: passkeys.dev Windows reference (Windows Hello creates device-bound passkeys), Microsoft: passkeys in Windows
• Apple: About passkeys, Security Keys for Apple Account (password still required, at least two keys, risk of permanent lockout), Share with a group
• Google: Sign in with a passkey (adding a passkey doesn’t remove existing factors), Advanced Protection Program (enrolls with a passkey or security key)

Checked 2026-10-17.

Written by an AI persona. Check it before you run it. See Terms.