What Happens to Your Passkeys If You Lose Your Phone
Passkeys are supposed to be unphishable and unstealable, but that safety depends on whether yours are synced to the cloud or bound to a single device. Here's what actually happens when the device is gone.
The whole pitch of a passkey is that it can't be phished, guessed, or stolen off a server in a breach: it lives on your device and never leaves. Which raises the obvious follow-up question nobody asks until the moment they're staring at a cracked screen or an empty pocket. What happens to years of passkeys when the device holding them is gone?
Are your passkeys gone if you lose your phone?
For most people, no. But the answer hinges on a distinction the industry hasn't done a great job explaining: synced versus device-bound. A synced passkey survives a lost phone. A device-bound one does not.
Synced passkeys are the default on modern phones. When you create one on an iPhone, it's written to iCloud Keychain and copied automatically to every other Apple device signed into the same account — an iPad, a Mac, a second iPhone. Google Password Manager does the same across Android and Chrome. Lose the phone, sign into the same account on a new one, and the passkeys are simply there. Third-party password managers like 1Password, Dashlane and Bitwarden sync passkeys the same way, independent of whichever phone maker you're using.
What if it was your only device?
This is where it gets less comfortable. If a passkey was device-bound — generated on a security key or an older implementation that didn't sync — losing that single device does destroy the credential, and you fall back to whatever recovery path the website built: email verification, SMS, a security question, or a support call. That fallback is, ironically, often weaker than the passkey it replaced, which is part of why security researchers have pushed hard for synced-by-default passkeys instead of leaving recovery entirely up to each individual site.
Even with synced passkeys and no backup device at all, most ecosystems provide a way back in: a recovery key, or an identity-verification flow through the platform's own support channel, though the exact process varies by provider and is worth knowing before you need it, not during. Apple's version runs through Account Recovery inside iCloud settings; Google's runs through its own account-recovery flow, which can take longer than people expect if there's no second signed-in device to confirm the request from.
What's the difference between a passkey and a hardware security key?
A hardware security key, the small USB or NFC dongle some banks and employers issue, is a physical, standalone form of device-bound credential by design. It's meant to never sync anywhere, which is exactly why security teams like it for high-value accounts: there's no cloud account to compromise, only a physical object to lose. The tradeoff runs the other way from a synced passkey. Lose the key with no backup key registered, and the account really is locked until a manual recovery process kicks in, which is why security-conscious setups typically register two hardware keys from the start, one carried and one stored somewhere safe, rather than relying on a single physical object the way people used to rely on a single spare house key.
Most people don't need that level of friction for an average online account, which is exactly why the industry pushed toward synced-by-default passkeys in the first place. The security key model is built for the accounts where losing access matters more than the inconvenience of managing a spare.
How do you protect against losing everything?
Lock down the account that syncs your passkeys, not the passkeys themselves. That means turning on two-factor authentication for your Apple ID, Google account, or password manager — the thing standing between a stranger with your lost phone and every account you've secured with a passkey. If the phone is merely lost rather than stolen, most platforms let you sign in on another device and remotely revoke the passkeys tied to the missing one, closing that door without waiting to find out whether it needed closing.
It's also worth checking, service by service, whether the passkeys you've created are actually syncing. On the same fragmentation that keeps a passkey created on an iPhone from working on an Android phone, a credential generated in a context that doesn't sync — an older browser implementation, a hardware key, certain enterprise setups — behaves like the device-bound kind even if you assumed it was safely backed up. The technology's biggest usability gap right now isn't the sign-in step. It's the invisible question of where, exactly, each of your passkeys actually lives.
