How to Set Up Passkeys Without Losing Access to Your Accounts

• Set up passkeys only on devices you personally own, and keep another trusted sign-in or recovery method available before removing your password.
• Synced passkeys can follow you to compatible devices through a credential manager, while device-bound passkeys may be lost when a phone, computer, or security key is lost.
• Before replacing a device, add a passkey on the new one, test it, review your account’s sign-in methods, and remove the old device only after access is confirmed.

What you need to know before setting up a passkey

Passkeys replace the part of a password that attackers can steal or trick you into revealing. Instead of typing a secret into a website, your phone, computer, or security key proves that it holds a private cryptographic credential. You then unlock that device with a fingerprint, face scan, PIN, or screen lock.

The important distinction is where the passkey is saved. A synced passkey is managed by a credential manager such as Google Password Manager, Apple iCloud Keychain, or Microsoft Password Manager and can become available on other compatible devices. A device-bound passkey stays on one device or physical security key. It can be highly useful, but losing that device can also mean losing that particular sign-in method.

Passkeys make phishing harder because the credential is tied to the legitimate website or app. They do not, however, remove every account-recovery risk. If someone can unlock your phone or computer, they may be able to use passkeys stored there. That is why setup and recovery planning matter as much as the passkey itself.

How to create your first passkey

The exact buttons vary by account, but the process is usually similar:

1. Sign in to the account using your current password and any existing verification method.
2. Open the account’s security, sign-in, or authentication settings.
3. Choose Create a passkey, Add passkey, or a similarly named option.
4. Confirm where you want to save it. The prompt may offer your current device, a password manager, another phone, or a physical security key.
5. Unlock the device to finish creating the passkey.

For a Google Account, the direct setup page is the account’s passkey and security-key management screen. Google advises creating passkeys only on devices you personally own and regularly use.

On Apple devices, passkeys are stored in iCloud Keychain when the required Apple account security settings are enabled. On Windows and Microsoft accounts, the passkey may be saved in Microsoft Password Manager, Windows Hello, a phone, another credential manager, or a FIDO2 security key.

Make a recovery plan before you remove passwords

Creating a passkey does not always delete your password. In many services, the password remains available as another sign-in method unless you deliberately change the account’s settings. That gives you time to confirm that the passkey works.

Before switching to a passkey-first setup, make sure you have at least two practical ways back into the account:

• A passkey on your primary phone or computer.
• A second passkey on another personal device or a compatible credential manager.
• A physical security key kept in a safe place, if the account supports one.
• An up-to-date recovery email address and phone number.
• Backup codes or another recovery method provided by the service.

Do not create a passkey on a family tablet, work computer that other people can unlock, library computer, or shared household device. Anyone who can unlock that device may be able to use the passkey. If you accidentally create one on a shared device, remove it from the account and from the device’s credential manager.

What happens when you replace or lose your phone?

If the passkey was synced through a credential manager, signing in to the same manager on a replacement device may restore access after the provider’s verification process is complete. This is one reason synced passkeys are convenient for everyday accounts.

If the passkey was stored only on the old phone, it may not transfer. Use another registered passkey, a security key, the account’s recovery process, or an existing signed-in session to add a new passkey. Do not erase or trade in the old phone until you have tested the replacement device.

When a phone is lost or stolen, treat the passkey as an account-access issue rather than merely a missing-device problem. From a device you still control:

1. Sign in to the account and review its passkeys, security keys, and active devices.
2. Remove the passkey associated with the missing phone when the service allows it.
3. Sign out the missing device from the account.
4. Change the password if you believe the phone may have been unlocked or compromised.
5. Check recovery details and recent security activity for changes you did not make.

For Google Accounts, a newly added sign-in method may not be fully trusted immediately. Google says some new passkeys or recovery changes can take up to seven days to become available, although an existing trusted passkey or security key may speed up certain changes. Plan device replacements before the old device disappears.

Synced passkeys versus device-bound passkeys

Neither type is automatically right for every account. The better choice depends on how much convenience, portability, and physical control you need.

A physical security key can be a strong backup, but it should not be your only route into an account. Consider registering two keys and storing them separately if the service supports multiple keys.

How to move passkeys to a new device safely

The safest order is to add first and remove later:

1. Keep the old phone or computer available and signed in.
2. Set up the credential manager on the new device and complete its identity checks.
3. Create or restore the passkey on the new device.
4. Sign out and sign back in using the new passkey.
5. Open the account’s security page and confirm the new passkey appears.
6. Only then remove the old device, old passkey, or old security key.

If the account offers a QR-code option such as “Use another device” or “Passkey from nearby device,” the old phone can sometimes approve a sign-in on the new computer. This does not necessarily copy every passkey to the new device; it may simply let the old device authenticate that one sign-in.

Common mistakes that cause passkey lockouts

Assuming every passkey syncs everywhere

A passkey saved through one provider may not automatically appear in a different provider’s credential manager. Check the save-location prompt instead of accepting the default without reading it.

Deleting the old phone too soon

A replacement device may appear ready while the account still relies on the old passkey. Test a complete sign-in before wiping, selling, or returning the old device.

Using only one recovery method

One phone, one passkey, and one recovery number create a single point of failure. Add a second trusted method for important accounts.

Confusing a passkey with a password manager login

The passkey protects a specific account, while your credential manager has its own account, device security, and recovery requirements. Protect both layers.

A practical passkey checklist

• Use a personal device with a strong screen lock.
• Read the save-location prompt before confirming.
• Keep your password or another recovery option until the new passkey is tested.
• Add a second passkey or security key for important accounts.
• Record backup codes in a secure location, not in a public note or shared document.
• Review account devices and passkeys after replacing a phone or computer.
• Remove lost, sold, returned, or shared devices from the account.

The simplest decision rule is this: use a synced passkey for convenience, add a second recovery route for resilience, and use device-bound keys when you specifically want credentials kept off cloud-synced systems. A passkey is safer when it is part of a recovery plan—not when it becomes your only door into the account.

Helpful Links

• Google Account passkeys and security keys – Create, review, and remove passkeys and security keys for a Google Account.
• Google Account passkey help – Review Google’s setup, sign-in, device replacement, and lost-passkey guidance.
• Apple Support: Use passkeys on iPhone – Learn how passkeys work with iCloud Keychain and how to use another device for sign-in.
• Microsoft Support: Create and save a passkey – Set up passkeys for Microsoft accounts and choose a device, password manager, phone, or security key.
• FIDO Alliance: Synced passkey deployment – Read technical background on synced and device-bound passkeys and account recovery.

Frequently Asked Questions

Q. Can I still use my password after creating a passkey?

A. Usually, yes. Many services keep the password available unless you change the account’s sign-in settings. Keep it or another recovery method until you have tested the passkey on more than one trusted route.

Q. Will a passkey automatically move from Android to iPhone or from iPhone to Windows?

A. Not necessarily. A passkey may sync within the credential manager that created it, but cross-platform availability depends on the provider, operating system, browser, and account. A QR-code sign-in can sometimes let one device approve access on another without transferring the passkey itself.

Q. What should I do if a passkey does not appear during sign-in?

A. Check that the device has a screen lock, that you are using the same credential manager account, and that the website or app supports passkeys. Try another sign-in method, then review the account’s registered passkeys and add a new one if necessary.

Q. Is a passkey stored on a shared family device safe?

A. No. Anyone who can unlock that device may be able to use the passkey. Remove the passkey from the account and the device’s credential manager, then create one on a device that only you control.