Published on 15 October 2026.
Losing a phone is stressful enough without discovering that it was your only route into an important account. Passkeys can make signing in easier, but the recovery question deserves attention before the device disappears.
The FIDO Alliance explains that passkeys can be synced through a provider or bound to a particular device. That distinction changes what you should prepare. A passkey on a hardware security key and a passkey synced through your password manager do not have identical recovery paths.
Find out where each passkey lives
Start with your main email, password manager and other accounts you cannot afford to lose. Open their security settings and identify the registered sign-in methods. Then check which provider stores each passkey and whether it is synced.
For a synced passkey, access on a replacement device depends on restoring access to the provider and meeting its security requirements. For a device-bound credential, losing the device may require another registered authenticator or the service’s recovery process. Follow the provider’s instructions rather than assuming that signing into any new phone restores everything.
Avoid a circular recovery plan
A recovery arrangement is fragile if opening your password manager requires an email account whose only sign-in method is stored inside that same inaccessible manager.
Draw a small map: account, sign-in method, recovery route and where the backup is kept. The purpose is to reveal dependencies. You do not need to put passwords or recovery codes into this map; it can simply record where the protected information is stored.
Where supported, consider a second registered authenticator kept separately. Store recovery material using the service’s recommended method, and protect it from people who should not have account access.
Test while your original device still works
Use another trusted device to verify the documented sign-in route. Keep the original session available until you are confident the alternative works. Do not delete your working credential merely to test recovery.
Check whether a family member could locate your instructions if you were unavailable, without giving that person unnecessary day-to-day access. A short, accurate note is easier to use than a folder full of screenshots from old settings.
If the phone is already missing
Follow the device maker’s lost-device guidance, then review active sessions and registered devices through accounts you can still access. Remove access that should no longer be trusted and contact the relevant provider if recovery fails.
Treat unexpected “account recovery” messages cautiously. Open the official service directly instead of following an unsolicited link. A lost phone should trigger a prepared recovery process, not an improvised search through messages from strangers.