Android Passkeys and Phone-Number Sign-In: Where It Breaks

A passkey removes the password. It does not remove the phone number that half your accounts still use to identify you or let you back in. On Android that gap shows up as recovery problems, prompts that appear on one phone and not another, and a quiet reliance on text messages.

Why phone-number accounts and passkeys fit badly together

A passkey proves you hold a private key that never leaves your device or vault. A phone number is a routing label owned by a carrier and reassigned on request. Most sites keep both: passkey to sign in, phone number to recover — so the account is only as strong as the weakest path that ends in a reset.

• Number recycling. Carriers reassign disconnected numbers after a holding period, so the next owner receives one-time codes and recovery links for any account still pointing at that number.
• SIM swap, port-out and carrier recovery. If a number can be moved to another SIM or carrier on request, anyone who passes that request receives your codes — and a text reset then works no matter how good your passkey is. Carrier account lookup or in-store verification is only as strong as the carrier's process.
• Identity by number. Messaging and regional services often use the phone number as the login name itself, so changing it can strand the account with no email address to fall back on.
• Order of operations. Sites that verify you by text before letting you add a passkey mean keeping the old number alive while you upgrade.

None of this is an argument against passkeys. It is an argument for treating the phone number as a credential, because that is how the account sees it.

Device, OEM and browser fragmentation is a real variable

Android is a stack: the manufacturer's system build, the Google services layer, your browser, and whichever credential provider you set as default. Any layer can be older, missing, or configured differently from your other phone.

• No Google services layer. Some devices and custom builds ship without it, so passkeys land in a browser or a third-party manager instead.
• Browser support varies. Some browsers create and use passkeys, some only use them, and some hand everything to the system provider.
• Secure storage depends on the screen lock. Changing the type of lock, or removing it, can invalidate enrolled biometrics and cut off access to credentials tied to the old lock.
• Where the passkey is anchored matters. A passkey in the Google vault follows the Google account, one in a third-party manager follows that manager's account, and one on a hardware key follows the physical key. The autofill provider setting is also per device.

What to check when a passkey prompt appears on one phone but not another

1. Secure screen lock present? Without a PIN, pattern or password, the system may refuse to offer or store passkeys at all.
2. Same vault account on both phones? Open the manager app and search the domain; the item has to be synced there.
3. Same default autofill provider? Compare that setting on each device directly.
4. Is the passkey listed at the site? If the site lists one, only one exists, and nothing is missing.
5. Is it a hardware key? A security key is bound to the object, so no phone offers it unless the key is present.
6. Is it a cross-device prompt? Scanning a QR code to use a passkey from another phone looks like success but does not put it on the second device.

A prompt that appears on one phone and offers only a password on the other is usually a provider or setting difference, not a broken account. More symptoms: passkey troubleshooting.

Should you remove SMS as a recovery factor?

Remove it where you can replace it, and not before. Text-message recovery is weak, but it is often the only route back into an account, and pulling it out too early converts a security problem into permanent lockout.

• Check for a hard requirement. Some services insist on at least one phone-based factor.
• Prove the replacement works first. Sign out and back in using the passkey or an app-based code, on a second device.
• Replace in order of strength: passkey, app-based one-time codes, a hardware key, then printed backup codes. Text recovery belongs last.
• Keep the number current everywhere. A forgotten account still pointed at a dead number can be recovered by whoever receives that number next.
• If the number is the login name, it is a permanent part of the account. Treat it as a credential, keep the SIM or eSIM under your control, and account for it before a phone change — see lost phone and passkeys.

Situation, risk, and what to do

Situation	Risk	What to do
Number you are giving up still receives the account's recovery messages	Recovery codes reach whoever gets the number next	Update it everywhere while you still control it; if removal is blocked, add a second passkey plus an app-based code and keep the old number until you have signed in without it
Account can still be reset by text alone	SIM swap or port-out becomes full takeover	Add a passkey, check whether text recovery can be disabled, and add whatever port-out protection the carrier offers
Passkey prompt missing on the second Android phone	No way in if the first phone is unavailable	Work the checklist above, then register a new passkey on the second device while still signed in
The only passkey lives on one phone, unsynced	A lost or factory-reset device takes the account with it	Register a second passkey on another device or in a vault with a desktop app — see passkey backup and recovery
Prepaid or frequently changing number is your only recovery contact	Recycled numbers and mis-delivered links, with no fallback	Add a second recovery email, prefer an account-based login name, and treat the number as one factor rather than the only one

What to do this week

1. Confirm each Android phone has a secure screen lock.
2. On your five most important accounts, count the passkeys and which vault each belongs to.
3. Add a second passkey for the two accounts you cannot afford to lose.
4. Check whether text-message recovery is still enabled, and what the site offers instead.
5. Note your recovery number, and update it as soon as it changes.

Choosing a vault that has to work across Android and a desktop is covered in password managers with passkey recovery and password managers for passkeys. Deciding whether to use passkeys at all first? See passkey or password manager first.

Last updated: 2026-10-16