Explainer — A passkey lets a device prove that you own an account without asking you to type that account’s password. You approve the sign-in using a device unlock, such as a fingerprint, face scan or PIN. The useful question is where that credential is stored and how you will sign in if the device disappears.
Losing a phone does not automatically mean losing every account. A passkey may be available through a credential manager on another approved device, or you may have registered a separate security key. Recovery becomes harder when the missing device held your only usable credential and you never prepared another route.
This guide explains the choices before that happens. It draws on current platform documentation, the WebAuthn standard and the UK National Cyber Security Centre’s April 2026 assessment of personal account security. The platform menus described here were checked in October 2026; availability can differ for managed work accounts.
In this article
- What a passkey actually changes
- Why passkeys resist fake login pages
- Where passkeys live: synced or device-bound
- How to start with Google, Apple and Microsoft
- Can your phone sign you into a different computer?
- What to do if your phone is lost or stolen
- What passkeys do not protect
- A practical checklist before you switch
What a passkey actually changes
A password is a secret that you supply to a service. A passkey uses a cryptographic key pair instead. The service registers a public key; the private part is held by an authenticator, such as a device or compatible security key. During sign-in, the authenticator signs a challenge, and the service checks the response. The website does not need to receive the private key.
Your fingerprint or face scan authorizes that operation locally. It is not a biometric password uploaded to each website. A PIN can also unlock an authenticator when the platform supports it. That distinction matters: the way you unlock a device and the credential proving your account ownership are different parts of the process.
Think of the public key as a way to check a response, rather than a reusable secret that grants access by itself. This changes what an attacker can obtain from a service’s credential database. It does not make the service’s other records, software or account-management processes immune to compromise.
Sources: FIDO Alliance — Passkeys overview and FAQ ↗ · W3C — Web Authentication Level 3, Recommendation of 25 August 2026 ↗ · Apple Support — About the security of passkeys ↗ · OWASP — Passkey Security Cheat Sheet ↗
Why passkeys resist fake login pages
Passkeys are scoped to a relying party: the service that asks you to authenticate. The browser and authenticator participate in checking the sign-in context, and the service verifies the response. A lookalike website cannot simply collect a password-shaped passkey and reuse it at the genuine service. This binding is central to phishing resistance.
The NCSC’s assessment recommends that individuals favour passkeys where available and use an additional factor when a password remains necessary. Its analysis also keeps an important boundary in view: stronger authentication still depends on a secure device, an appropriate credential provider and recovery arrangements.
Picture a convincing email that sends you to a fake login page. With a password, you can type the secret into the wrong place. A correctly implemented passkey ceremony changes that interaction. But if the attacker persuades you to use an available password or recovery-code fallback instead, that weaker route remains relevant.
Sources: W3C — Web Authentication Level 3, Recommendation of 25 August 2026 ↗ · UK NCSC — Security comparison for personal FIDO2 credentials, 23 April 2026 ↗ · OWASP — Passkey Security Cheat Sheet ↗
Where passkeys live: synced or device-bound
A synced passkey is managed by a provider that can make it available on your other approved devices. Apple uses iCloud Keychain, and Microsoft’s creation flow offers synced credential managers alongside other storage choices. The practical advantage is continuity: one broken phone need not be your only way into an account.
A device-bound passkey stays with a particular authenticator rather than following you through a sync service. A compatible hardware security key is one option. You must plan how to replace or supplement that authenticator, because a credential you cannot access cannot help you sign in.
Check the save-location prompt before accepting it. A passkey stored locally through Windows Hello and one saved to a synced manager can have different availability later. Also distinguish creating another passkey for an account from copying an existing credential: services can let you register separate authenticators without making them the same key.
Sources: FIDO Alliance — Passkeys overview and FAQ ↗ · Apple Support — Set up iCloud Keychain, updated 1 October 2026 ↗ · Microsoft Support — Create and save a passkey ↗
How to start with Google, Apple and Microsoft
Google account: open your account’s Passkeys and security keys settings, choose to create a passkey and complete the device-unlock prompt. Use a device you personally control. Google says adding a passkey does not remove your existing authentication or recovery factors, so review those separately rather than assuming the account has become exclusively passwordless.
Apple devices: first check the provider that will store the passkey. Apple’s iCloud Keychain instructions place synchronization under Settings, your name, iCloud, then Passwords, followed by Sync this Device. Older software may use the Passwords and Keychain label. On a Mac, the corresponding route starts in System Settings. Enabling sync makes supported credentials available on approved devices; it does not automatically create passkeys for every website.
Microsoft personal account: go to Advanced Security Options, add a new way to sign in or verify, then choose Face, Fingerprint, PIN, or Security Key. Read the proposed save location. Microsoft offers a synced manager, a phone or tablet, a physical key, and local Windows Hello storage, depending on the environment.
For a work or school account, use the organization’s supported process. Microsoft explicitly notes that administrators can restrict the available methods. A missing option on a managed laptop may therefore reflect policy. Check with the organization before trying to replace a required sign-in method.
Sources: Google Account Help — Sign in with a passkey instead of a password ↗ · Apple Support — Set up iCloud Keychain, updated 1 October 2026 ↗ · Microsoft Support — Create and save a passkey ↗
Can your phone sign you into a different computer?
Yes, where the service and devices support cross-device authentication. Google documents a flow in which the computer shows a QR code, you scan it with your phone, approve the request and unlock the phone. Bluetooth must be enabled for the supported nearby-device flow.
This is useful when the computer does not hold the passkey you need. It is different from synchronizing that credential into a manager on the computer. Treat the approval as a sign-in to that particular device and check that it is the session you intended to open. A successful nearby sign-in is not evidence that you have created a recovery backup.
Sources: FIDO Alliance — Passkeys overview and FAQ ↗ · Google Account Help — Sign in with a passkey instead of a password ↗
What to do if your phone is lost or stolen
Start with a device or recovery method you can still access. Google lists alternatives including another signed-in phone, a previously saved backup code, a registered hardware security key and a passkey on another device. The available route depends on what you set up before the loss. These options are worth checking while everything still works.
For Apple users, approved-device synchronization provides redundancy, and Apple also documents recovery protections for iCloud Keychain. Recovery has its own account-verification requirements. Knowing your email address alone is not a substitute for satisfying them, so review the official recovery process before relying entirely on one ecosystem account.
After regaining access, deal with the missing device and its credentials. Google’s guidance includes signing out of a lost or stolen phone, changing the Google Account password and removing the passkey associated with that device. Review account-side credentials as well as saved entries in your credential manager: those are different management surfaces.
If the only passkey was device-bound and the authenticator is gone, that credential will not reappear through cloud sync. You will need another registered authenticator or the service’s recovery procedure. Replacing the physical phone and recovering a particular account are separate tasks, even when they happen on the same day.
Sources: FIDO Alliance — Passkeys overview and FAQ ↗ · Apple Support — About the security of passkeys ↗ · Google Account Help — Recovery and lost-device guidance ↗
What passkeys do not protect
Passkeys improve authentication. They do not repair a compromised device, an insecure account-recovery process or a broken application. OWASP’s security guidance explicitly separates passkey verification from risks such as stolen authenticated sessions, unauthorized credential enrollment and weaknesses in the account used to synchronize credentials.
This matters in ordinary use. A browser session that is already signed in has value to an attacker, even if the original login used a passkey. Keep your device and browser secure, pay attention to account-change notifications and investigate unfamiliar credentials. Better sign-in should accompany good account management rather than replace it.
The NCSC similarly identifies device security, credential-manager selection and secure recovery as conditions for realizing the benefits. Avoid treating the presence of a passkey as proof that every remaining route into the account has the same protection.
Sources: UK NCSC — Security comparison for personal FIDO2 credentials, 23 April 2026 ↗ · OWASP — Passkey Security Cheat Sheet ↗
A practical checklist before you switch
First, choose where the passkey will live and confirm that you can use that provider on the devices that matter to you. Next, test a second usable sign-in route while you still have the original device. Depending on the service, that might be another registered passkey, a separately kept compatible security key or a documented recovery method.
Then review device locks, account recovery details and the security of the account that synchronizes your credentials. Keep any recovery codes securely stored away from the single device whose loss you are planning for. Finally, inspect the account’s registered credentials so you know which devices or keys should be there.
The decision becomes easier once you answer two concrete questions: where is my passkey, and what will I use if I cannot reach it? A useful first step is to enable a passkey on a supported account, verify your backup route and make the same deliberate choices as you add more accounts.
Sources: FIDO Alliance — Passkeys overview and FAQ ↗ · UK NCSC — Security comparison for personal FIDO2 credentials, 23 April 2026 ↗ · Microsoft Support — Create and save a passkey ↗ · Google Account Help — Recovery and lost-device guidance ↗ · OWASP — Passkey Security Cheat Sheet ↗