Your phone has vanished, and your first thought is the photos. Your second thought is less sentimental: Was that also the key to every account I own? With passkeys, losing a phone does not automatically mean losing your accounts. The answer depends on where the passkey was stored, whether another copy is available, and how the account lets you recover access.

The useful preparation is to check those three things while your phone is still comfortably in your pocket. A recovery plan written after a theft has the same timing problem as buying an umbrella inside a thunderstorm.

First, separate the passkey from the phone

A passkey is a cryptographic sign-in credential, rather than a password you remember. The website keeps a public key; the private key is used to prove that you can sign in. On Apple devices, a face, fingerprint or device authentication can authorize its use. The biometric check is not the passkey itself. Apple explains the public-key design and its implementation.

FIDO distinguishes synced passkeys, which a credential provider makes available across devices, from device-bound passkeys, which remain on one authenticator, including some security keys. FIDO also says biometric processing stays on the device rather than being sent to the website. Check which kind you actually created: the same friendly sign-in button can conceal different recovery arrangements. FIDO's passkey explanation and FAQ describe these distinctions.

Think of this as a household-key question. Before worrying about a lost key, establish whether another usable key exists and who can issue a replacement. The analogy explains the planning problem; it is not a description of how cryptographic secrets are copied.

What happens in the three common loss scenarios?

A recovery decision aid; exact options depend on your provider and account

Your situation	What to check first
You have another trusted device	Check whether it already has a usable passkey or another accepted sign-in method.
You bought a replacement phone	Follow your credential provider's recovery instructions before assuming the passkey will appear.
The only credential was on the missing device	Use the website's documented alternative sign-in or account-recovery process.

Synced credentials offer redundancy, but recovering the provider account is a separate step. Apple says iCloud Keychain passkeys are end-to-end encrypted and describes recovery protections for the case where all devices are lost. That is an account-specific recovery process, not a promise that possession of a new iPhone alone restores everything. Read Apple's recovery-security explanation and check your own recovery settings.

For a device-bound credential, the question is whether you registered another authenticator or the service permits another way back in. Do not erase a working device to discover the answer. Open the service's security settings and read its recovery instructions first.

A Google Account example, without pretending every website works alike

Google says you can choose Try another way to return to earlier sign-in choices. On an accessible device, you can remove a passkey associated with a lost or stolen device. For a passkey automatically created by an Android device, Google's instructions instead point to that device's sessions and signing out. The distinction matters: removing the wrong item is a poor substitute for understanding which device still has access. Google's passkey sign-in and lost-device instructions cover the steps.

Use those instructions for a Google Account. A shopping site, employer account or password manager may offer different alternatives. Make a small list of your important accounts and put the relevant recovery-help link beside each. That list needs instructions, not passwords or secret recovery codes.

A ten-minute recovery rehearsal

Here is a hypothetical example. Meera uses a phone for personal email and a laptop for work. She assumes the phone is her only route into email, but she has never checked. Her rehearsal is an inspection, not a simulated disaster.

1. She opens the email account's security settings on her working device and identifies the registered passkeys and alternative methods.
2. She checks which credential provider holds the passkey and reads that provider's recovery requirements.
3. She confirms that her recovery contact details are current and that she can actually access the separate recovery destination.
4. Where supported, she sets up an additional trusted sign-in method and verifies it works without deleting the existing one.
5. She stores any service-issued recovery codes according to the service's instructions, away from a single point of failure such as the same missing phone.

The result is a concrete answer: “I can use this other method” or “I need to fix this dependency.” That is much more useful than “I think everything syncs.” Avoid signing out of every device or removing credentials as part of the rehearsal. First establish a working route back in.

Does this mean passkeys are unsafe?

No. FIDO describes passkeys as phishing-resistant; recovery planning addresses a different problem: keeping access when devices change or disappear. Authentication security and account availability both matter. Neither a convenient login nor a spare credential makes every possible account-recovery path safe. FIDO's FAQ explains the authentication properties.

This is already a practical issue. FIDO's Passkey Index, published on 15 October 2026, reports a 36% average share of successful sign-ins using passkeys across the 12 participants reporting that measure. The report's methodology says these are unweighted averages, and its group of participants changed from 2025. It is evidence from participating services, not a census of all internet sign-ins, a like-for-like growth measurement or a ranking of search questions.

Our older strong-authentication article provides historical background. The question to add today is operational: if the device is gone, what exact sequence gets you back into the account?

The one thing to do today

Choose your most important email account. Identify its passkey provider, confirm a second usable sign-in route if the service offers one, and read the lost-device procedure. Repeat for the accounts whose loss would hurt most. You do not need to become a cryptographer; you need a recovery plan that names real steps.

Preparation note — 19 October 2026: Prepared with AI assistance for research organisation and writing. The linked primary documentation and report were checked for the claims above. The rehearsal is hypothetical; no account-loss experiment or hands-on recovery test was performed. Provider guidance can change.