Set up a passkey without losing your recovery route
Understand device-bound and synced passkeys, create one on a trusted device and test sign-in before removing older methods.
In brief
A passkey uses cryptographic keys to sign in, usually after you unlock a device with its PIN or biometric check. Unlike a typed password, it is bound to the intended service, which helps resist fake sign-in sites.
The useful setup includes recovery: know where the passkey lives and how you will sign in if the phone or computer is lost.
Identify where the key will live
A passkey may be stored on a hardware security key, on a device or in a syncing password manager. Read the prompt before accepting. Do not create a passkey on a shared computer merely because it offers one; another person who can unlock that device may be able to use it.
Test before removing alternatives
For a Google account, use its Passkeys and security keys settings and test a new sign-in from a supported browser. Keep another supported method available until you understand device replacement and recovery. Removing all existing routes during the first setup creates an avoidable lockout risk.
Respond to a lost device
Use a trusted remaining device or recovery route, inspect registered passkeys and remove the lost device’s access according to the service instructions. Secure the syncing provider account too. A remotely locked phone and a removed service credential solve different parts of the problem.
Before you act
A passkey does not protect every action on an already unlocked or compromised device. Synced passkeys also depend on the security and recovery of their credential-provider account.
What to do next
- Open the service’s security settings directly on a device you control.
- Create a supported passkey and confirm where it is saved.
- Test a fresh sign-in, then preserve a supported backup authenticator or recovery route.
