A passkey lets you sign in by approving a request with a device PIN, a fingerprint, a face scan, or a hardware security key, depending on your setup. Before changing how you sign in to an important account, choose where the passkey will live and test access from another device while you still have your current one. Account recovery is part of setting up the passkey.
Understand what a passkey does
When you create a passkey, your authenticator creates a pair of cryptographic keys for the service. The service holds the public key. The authenticator uses the private key to prove you can sign in. Your fingerprint or face is typically checked on the device to authorize that operation. The website receives the authentication result rather than a copy of the biometric data. A supported device PIN can also authorize the same process.
A passkey is tied to the service it was registered with. That origin binding is what helps it resist a phishing page on a lookalike domain. If an account still accepts a password and its recovery channel can be tricked, those paths need attention too. Check the security settings for ways to sign in, add a device, and recover access. Keep recovery details current and use the service’s own bookmarked address when changing them.
The FIDO Alliance passkey guide explains the difference between synced and device-bound credentials. A synced passkey can be available on other devices through its provider, subject to the provider’s sign-in and recovery rules. A device-bound passkey stays on its authenticator, which can be a device or a hardware security key. Record which one you choose before relying on it.
Choose where to store the passkey
Start with the devices you use to access the account. If you use a phone and a laptop from different platforms, check which passkey provider is available in the browser and operating system on each one. A passkey saved into one provider may not appear automatically in another. Check the provider name when the browser or system asks where to save it. That small detail will tell you where to look later.
If you prefer a hardware security key, confirm that the service supports registering one as a passkey or another authentication method. Some services offer both options with different sign-in and recovery behavior. If a critical account supports multiple passkeys, consider a second registered authenticator that you can reach if your primary device is lost. Check where you will store it and whether you can use it with your usual phone or computer.
Avoid testing for the first time on your only route into a critical account. A lower-stakes account with an existing recovery option makes a better test. If the account belongs to your employer, check its policy before registering a personal authenticator. A managed browser or device can constrain your choices, and a workplace account may have its own help desk recovery process.
Register and test a passkey
Sign in at the service’s known address. Open its account security or sign-in settings and find the option to create a passkey. Check which account you are editing if you have both personal and work profiles. When prompted, choose the intended password manager, platform provider, or security key. Approve the request using the device’s normal unlock method. If the service allows a label, use one that identifies the provider or hardware key.
Keep the original signed-in session open. Start a separate session using a different browser profile or another device you control. Navigate to the service and try the passkey option. If it is a synced credential, check whether the expected passkey is offered. If the service offers a QR code to sign in using your nearby phone, follow its official cross-device instructions. Successful cross-device sign-in can use the passkey on the phone without saving a copy on the computer.
If the prompt offers the wrong provider, cancel and inspect the browser profile and system credential settings. Try the same steps in the environment you will use routinely. Also test how to sign in if the biometric prompt fails and the device asks for its PIN. Write down the route you used in a place you can reach after replacing the device, without copying secrets into an unprotected note.
Make a recovery plan before replacing a device
Check the account’s recovery email, phone, registered authenticators, and any recovery codes it issues. Keep recovery codes in a protected location you can access independently of the affected account. For example, avoid storing the only copy inside the mailbox that those codes would help you recover. If the passkey provider has its own recovery steps, verify those as well. One account can be the recovery path for several others, so note the order in which you would recover them.
When moving to a new phone, keep the old one until you have signed in on the new device and checked critical accounts. If a credential did not sync, use an existing supported sign-in method to register another passkey from the new device, then test it. Remove registrations for lost or retired devices from account settings when appropriate. If a provider shares one synced credential across several devices, removing the credential from the service can affect every device that uses it. Check the registration name and provider before removing anything.
Run a dry test while you still have all your devices. Take a list of two or three important services and check which ones you could sign in to if your main phone were unavailable. Verify your backup authenticator works, or confirm the recovery page offers the method you expected. Store a protected copy of your recovery notes using the principles in our backup and restore guide. Browse Security & Privacy for related account and device guides.
For a family account, work out who needs access and use the service’s sharing or delegated access feature where available. A personal passkey can depend on one person’s device unlock and recovery options. Document where the service’s account recovery process starts, and identify who can complete it. Keep personal and shared credentials in the appropriate accounts. If a family member changes devices, repeat the sign-in check while the old device and the existing recovery methods are still available. This makes it easier to fix a provider mismatch while someone can still get into the account.
Frequently asked questions
Does the website receive my fingerprint?
The device or authenticator uses its local verification method to approve the sign-in. The website receives proof from the authenticator.
Can I use the same passkey on multiple devices?
A synced passkey can be available on multiple devices supported by its provider. A device-bound passkey stays on its authenticator.
What happens if I lose my phone?
Use another synced device, a registered backup authenticator, or the service’s recovery method. Which route works depends on your account and provider setup.
Should I remove my password immediately?
First verify a second way to sign in and confirm the recovery path. Then follow the service’s guidance for the sign-in methods it lets you keep or remove.