Passkeys explained through setup, sign-in and recovery

A passkey changes how you authenticate, but it does not remove the need to understand recovery. Review setup, ordinary sign-in and a lost-device scenario as three separate parts of the account lifecycle.

FIDO Alliance describes passkeys as public-key-based, phishing-resistant authentication. That property should not be expanded into a promise that an account is immune to every form of compromise or that all products recover access in the same way.

Keep three notes for the account: where the passkey is available, how ordinary sign-in works and which recovery route the provider documents. Having them together makes the account arrangement easier to understand when adding a device or planning a replacement.

Check the account and platform together

Identify where the passkey is created or stored and which devices or authenticators can use it under the product’s documented arrangements. Check the product’s documented availability and synchronisation arrangements for each device you use.

Read the service’s instructions for adding another supported sign-in method or device. Keep a working access route available while setting up and checking the new arrangement.

Ask the recovery questions now

The questions may have different answers for different accounts even on the same phone.

Verify the routine

Following the product’s instructions, confirm that ordinary sign-in works and that you understand the documented recovery path. Record setup, ordinary sign-in and recovery checks separately, with the outcome of each. Revisit the arrangements when replacing a device or changing the platform account associated with your credentials.

What happens during a passkey sign-in?

A passkey uses a public/private key pair associated with the account and website. The service stores the public key. During sign-in, an authenticator uses the private key to sign a challenge, and the service checks that response with the public key. MDN’s passkey guide describes this registration and sign-in flow.

This explains why the location and availability of the authenticator matter to the user. FIDO distinguishes synced passkeys from device-bound passkeys. Check which arrangement applies to the credential being set up and which devices it supports. The recovery plan then addresses what remains available if the normal sign-in device is lost or replaced.

Make an account access map

Start with one account and list the devices on which you need to sign in. For each, record the supported method from the account and platform documentation. Keep this as a description of the arrangement, without including secret recovery material in an ordinary shared note.

FIDO’s explanation of passkeys covers the authentication mechanism. The account provider and the platform supply the practical recovery details for their particular arrangement.

Walk through replacement before retiring a device

Imagine replacing a phone. Keep the old device available while following the documented setup on the new one. Confirm ordinary sign-in to the intended account, then review how access would work if the new phone were unavailable.

Record the date and what was checked: setup, sign-in or a paper walkthrough of recovery. A walkthrough can reveal an unanswered question without requiring the account to be locked as an experiment. Resolve that question through the provider’s instructions before removing an access route you still need. This leaves a clear handover between the old and new arrangements.

Walk through a lost-device scenario on paper using the provider’s instructions. List what the recovery route requires and where those resources would be available. Any question that comes up can then be checked while the current access arrangement is still working.

Sources consulted

• Passkeys — FIDO Alliance; checked 4 November 2026.

• Passkeys — MDN; checked 4 November 2026 for the registration and sign-in mechanism.