Passkeys Explained: How to Log In Without Passwords (and What to Do When You Switch Phones)
Passkeys are replacing passwords on phones and laptops. Learn how they work, where they’re stored, and how to avoid getting locked out when you upgrade devices.
- Passkeys use your device lock (Face ID, fingerprint, PIN) instead of a memorized password.
- They’re usually synced through Apple/Google/Microsoft accounts—great for convenience, but plan for device changes.
- Set up at least one backup sign-in method and a recovery path before you need it.
What a passkey is (in plain English)
A passkey is a modern way to sign in that replaces (or reduces the need for) passwords. Instead of typing something you can forget, reuse, or accidentally give to a scammer, you confirm sign-in using something you already do every day: unlocking your device with Face ID, a fingerprint, or a device PIN.
Here’s a simple mental model: a password is like a code word you tell a bouncer. A passkey is like the bouncer scanning a secure badge that never leaves your pocket. You don’t “say” the secret; your device proves you have the right credential.
In real life, passkeys show up when a website or app says something like:
- “Sign in with passkey”
- “Use Face ID / fingerprint to sign in”
- “Create a passkey” in account security settings
When you use a passkey, your device creates a special pair of digital keys:
- A public key that the website can store safely (it’s not secret).
- A private key that stays on your device (this is the secret part).
When you log in, the website sends a challenge. Your device answers it using the private key after you unlock the device. The website checks the answer using the public key. No password needs to travel across the internet, and there’s nothing useful for a phishing site to “steal” by tricking you into typing it.
Why people are talking about passkeys right now: big platforms and many popular services are rolling them out, often presenting them as the “recommended” sign-in method. That makes passkeys feel suddenly unavoidable—in a good way, but also with new questions like: “What happens if I lose my phone?”
Where passkeys live: device-only vs synced (and why it matters)
One of the most important (and most confusing) parts of passkeys is where they’re stored. The experience can be smooth or stressful depending on this detail.
There are two common setups:
| Passkey type | Where it’s stored | What it feels like | Best for |
|---|---|---|---|
| Device-only | On one specific phone, tablet, or security key | Super secure, but you must have that device | High-security accounts, shared workstations, admins |
| Synced | Saved in your platform’s passkey manager (e.g., Apple, Google, Microsoft) and synced to your other devices | Convenient—new phone can get passkeys back after you sign into your account | Everyday logins across phone + laptop |
Why this matters: if your passkey is device-only and the device is gone, the passkey may be gone too. If it’s synced, you can often restore it by signing into the same Apple/Google/Microsoft account on a new device. “Often” is doing a lot of work there: recovery still depends on how well you can prove you’re you.
Let’s put it in a short scenario.
Scenario: Nina creates a passkey for a shopping site on her phone. Months later she buys a new phone.
- If the passkey was synced through her platform account, she signs into her platform account on the new phone, and the passkey appears.
- If the passkey was device-only, the new phone doesn’t have it. She’ll need another sign-in method (like email verification, a backup code, or an authenticator app) to get back in and create a new passkey.
A helpful rule of thumb: treat your platform account (Apple ID, Google Account, Microsoft account) like the “master keyring” for many passkeys. Securing that account well makes your passkey life much easier.
How to start using passkeys without getting locked out
Passkeys are designed to be safer and easier than passwords—but only if you set them up with a little foresight. Below are practical steps that keep things simple, especially when you switch phones, lose a device, or use a mix of personal and work gadgets.
1) Add passkeys gradually (start with low-drama accounts)
If you’re new to passkeys, start with an account you use often but isn’t catastrophic if you need to go through recovery once—like a shopping site, a newsletter tool, or a social app. This lets you learn the flow: create passkey → sign out → sign in again → see what prompts appear on your phone or laptop.
2) Keep at least one backup sign-in method active
When an account offers passkeys, it usually still supports other ways to log in. Don’t disable everything else on day one unless you’re confident about recovery. Useful backup methods include:
- Email or SMS codes (not perfect, but better than being locked out)
- Authenticator app (time-based codes)
- Backup codes you can print or store in a safe place
Think of it like moving to a new apartment: you can start using the new front door, but keep a spare key with someone you trust until you’re fully settled.
3) Prepare for “new phone day” before it happens
Most lockouts happen during device changes—not during ordinary logins. A smooth upgrade usually comes down to three checks:
- Can you sign into your platform account on the new device? (Apple/Google/Microsoft)
- Do you still have access to your recovery email/phone number?
- Is your old device still available long enough to transfer data?
If you’re the type who trades in your old phone immediately, pause and confirm your new phone is fully set up and signed into the right accounts before wiping or handing over the old one.
4) Understand the “approve on your phone” prompt
Sometimes you’ll try to sign in on a laptop and you’ll see a QR code. You scan it with your phone, unlock your phone, and you’re in. This can feel like magic, but it’s simply your phone using the passkey to confirm the login for the laptop session.
Two quick safety habits make this more comfortable:
- Only approve prompts you started. If your phone asks you to approve a sign-in out of nowhere, deny it.
- Check the site name carefully. Passkeys are resistant to phishing, but you should still avoid getting trained to approve random prompts.
5) Use a second device or a hardware security key for critical accounts
For accounts that would be a nightmare to lose (primary email, password manager, financial tools), redundancy is sanity. If possible, add either:
- a second passkey on another device (like a tablet or secondary phone), or
- a hardware security key (USB/NFC) as an additional sign-in option.
This is the same logic as having two house keys. One is convenient; two is resilient.
6) Watch out for the “work vs personal” mix-up
A common everyday problem: you create a passkey on a work laptop, but it’s tied to a work-managed account that you might lose access to when you change jobs. Or you save passkeys in a browser profile you rarely use.
If you can, keep a simple system:
- Personal accounts → stored/synced under your personal platform account
- Work accounts → stored/synced under work-managed accounts only if your IT policy expects that
It’s not about being perfect—it’s about avoiding surprises later.
7) What to do if you already switched phones and something broke
If you’re reading this because you can’t log in right now, try this order (fastest to slowest):
- Try a different device you previously used (old phone, tablet, laptop). Synced passkeys may still be available there.
- Use the site’s alternative sign-in (email code, SMS, authenticator, backup codes).
- Regain access to your platform account (Apple/Google/Microsoft). If the passkeys were synced, restoring that account often restores your passkeys.
- Account recovery with the service (may include identity verification and waiting periods).
Not exactly. Passkeys replace the password step by using cryptographic proof. Some services treat passkeys as strong enough to reduce extra prompts, but you may still add 2FA for extra protection—especially for critical accounts.
Not exactly. Passkeys replace the password step by using cryptographic proof. Some services treat passkeys as strong enough to reduce extra prompts, but you may still add 2FA for extra protection—especially for critical accounts.
They would usually need to unlock your phone first (Face ID/fingerprint/PIN). That’s why a strong device passcode matters. If your phone is lost, use your platform’s “Find My”/device management tools and account security pages to lock or wipe it.
They would usually need to unlock your phone first (Face ID/fingerprint/PIN). That’s why a strong device passcode matters. If your phone is lost, use your platform’s “Find My”/device management tools and account security pages to lock or wipe it.
Often, yes—especially when you can approve sign-in using a QR code from your phone. But syncing passkeys across ecosystems can be less seamless than staying within one platform. If you regularly mix devices, keep a backup sign-in method enabled.
Often, yes—especially when you can approve sign-in using a QR code from your phone. But syncing passkeys across ecosystems can be less seamless than staying within one platform. If you regularly mix devices, keep a backup sign-in method enabled.
A small habit that pays off: anytime you create a passkey, take 30 seconds to check the account’s “Security” page and confirm you still have a recovery email/number, plus at least one backup method. It’s boring in the moment—and extremely relaxing later.