What happens to passkeys if you lose your phone?

In most cases you do not lose them. Most passkeys are synced passkeys: the FIDO Alliance notes they can be securely synced across a user’s devices, and Apple stores passkeys made on an iPhone or Mac in end-to-end encrypted iCloud Keychain, so they carry over to your other signed-in devices. Apple says passkeys stay recoverable through iCloud Keychain escrow even if you lose every device, as long as you can sign back in to your Apple Account.

A thief cannot simply use the passkeys on a lost phone, because each sign-in requires unlocking the device with your fingerprint, face, or screen-lock PIN. Google recommends signing in from another device and removing the passkey tied to the lost or stolen phone. Device-bound passkeys, such as those on a hardware security key, do not sync, so the FIDO Alliance advises keeping a backup key or another recovery method on each account.

Source: Apple Support, “About the security of passkeys”. See also Google Account Help, “Sign in with a passkey instead of a password” and FIDO Alliance, “Passkeys”.

Image: Google Titan Security Key, photo by Tony Webster (CC BY 2.0), via Wikimedia Commons.

Leave a Comment