Before You Switch to Passkeys, Make a Recovery Plan
Passkeys can make everyday sign-in simpler and resist phishing. A careful first setup also answers a less exciting question: what happens if your phone disappears?
In this article
The appeal of a passkey is easy to understand: open a service, confirm with your device, and get on with the day. There is no long password to remember or paste into the wrong page. The part worth planning is what happens when the device you usually reach for is unavailable.
What changes when you use a passkey?
The FIDO Alliance’s explanation describes passkeys as credentials based on public-key cryptography. The service keeps a public key, while your authenticator uses the matching private key to prove you can sign in. Authentication is bound to the service, which helps resist lookalike-site phishing.
Passkeys may be synchronized through a provider or kept on a particular device or security key. That distinction matters when you move between devices. A passkey is not simply a shorter password, and the screen-lock code that unlocks your phone is not the credential a website stores.
Start with one account you understand
Our recommendation is to begin with one personal account rather than changing every login in an evening. Before making a change, review the account’s recovery email, recovery phone if used, and other recovery options. Check that those details still belong to you.
Then identify where the new passkey will be saved. Read the provider name in the setup prompt. If you use several password managers or different operating systems, do not assume they all share the same credentials.
A Google Account example
Google’s passkey help page explains its supported devices and browsers, screen-lock requirements, and account-specific setup. It notes that adding a passkey does not remove existing authentication or recovery factors. Biometric information used to unlock the device stays on the device.
For a Google Account, follow the current passkey setup flow from the account’s security settings and use a personal device you control. Work or school accounts may be subject to administrator policies. Do not treat the behavior of a personal account as a guarantee that an employer’s account will work identically.
Test before removing anything
After setup, try a normal sign-in while you still have a working signed-in session available. Confirm that the expected provider appears and that the account opens successfully. If you regularly use a second computer, test that workflow too.
A useful personal checklist has three entries: the device you normally use, an alternative supported way to sign in, and the account-recovery process. You do not need to publish this information or share it with anyone. The point is to know your route back before a stressful moment forces you to find it.
The lost-phone question
Imagine your phone is lost during a trip. Could you reach your email from another trusted device? Do you know which provider manages your passkeys? Can you access that provider’s recovery instructions without relying entirely on the missing phone?
Use those questions to identify gaps. Where a service supports backup recovery codes, store them securely using its guidance. Where it supports another authenticator, consider whether that is appropriate for your needs. Avoid making one borrowed or shared device the only route into important accounts.
Keep ordinary account hygiene
Phishing resistance is valuable, but it does not make every message, attachment, or support request trustworthy. Continue reviewing suspicious activity, protecting your device lock, and removing access from devices you no longer use. Recovery channels deserve the same attention as the main login.
A good passkey setup should feel uneventful. Start small, understand where the credential lives, and test the fallback. Convenience is much more convincing when it survives a lost device.
Documentation checked September 23, 2026. Setup and recovery options vary by service and credential provider.