What changes compared with a password?
Passkeys use a cryptographic key pair and are bound to the service they were created for. FIDO describes them as phishing resistant. Unlocking can use a device PIN or biometrics; your fingerprint does not become a password you hand to every website. [1]
This reduces a familiar problem: typing a reusable secret into an imitation website. It does not remove every account risk. An unlocked device, compromised recovery email or stolen session still deserves attention. Think of a passkey as a specific improvement to sign-in security, rather than insurance against every incident.
Find out where your passkey lives
Some passkeys synchronize through a provider; others are bound to a device, including certain security keys. FIDO explains that recovery depends on this distinction. Do not assume a hardware-key credential will appear on a new phone, or that switching ecosystems automatically transfers every credential. [2]
Make a simple inventory of important accounts. For each, record the service, the manager storing its passkey and the available recovery options. Do not copy secrets or recovery codes into that inventory. The purpose is to know where to look when changing phones, not to create another sensitive file.
A five-step migration
- Keep the old device. Do not reset it at the start of the migration.
- Prepare the replacement. Update it, set a secure screen lock and sign into your credential manager.
- Check essential accounts. Start with email and your password manager. Keep a backup session open while testing a fresh sign-in.
- Test the alternative. Check the recovery procedure offered by each service and store any recovery codes securely.
- Retire the old phone. After confirming the new access works, review old sessions and credentials before erasing or handing over the device.
This sequence is our proposed way to organize a migration. It is not an identical procedure for every provider: follow their instructions where they differ, and avoid deleting your only access route during a test.
If the phone is already lost
Use the service’s recovery options from a trusted device. Google allows passkeys associated with a lost device to be removed and related sessions reviewed; its documentation distinguishes manually created credentials from those automatically registered on Android. [3]
Recovering an account does not recover the phone or automatically erase its files. Also review the official locking and device-location features of your operating system. For a work account, contact its administrator before changing managed authentication methods.
The final check is concrete: can you sign in without the old phone, and do you know what to do if you lose the replacement? If you have only checked that an existing session remains open, you have not yet verified the access migration.
Rehearse switching phones before erasing the old one
Perform this rehearsal before selling or resetting your phone. The goal is to prove access from the new device while the old one is still available to resolve problems.
- Identify where each passkey lives: a syncing provider, device or physical security key.
- Check recovery for the account that synchronizes your keys.
- Sign in on the new device and test two important services from fresh sessions.
- Verify that access does not depend on approving a request on the phone you will remove.
- Only after confirming access and recovery, remove old-device methods and reset it following manufacturer instructions.
A key bound to a physical security key should not be assumed to appear through synchronization. If access still depends on the old phone, stop and configure another method supported by the service. Never publish or send recovery codes when asking for help.
Sources and documentation
Sources consulted on October 7, 2026. Original documentation; linked sources may be in English.
