Passkey Backup and Recovery Options, Explained

"Backup" means different things for different passkeys, and the difference decides whether losing a device is an annoyance or an emergency. This page separates the three kinds of backup apart, then walks through a simple method you can run on your own accounts.

What "backup" actually means for a passkey

The word "backup" hides three different things, and mixing them up is why people feel safe when they are not. A passkey is not a file you copy into a folder in the ordinary sense; how it can — or cannot — be restored depends on which of these you are relying on.

Sync

Many passkeys are synced through a platform cloud keychain, so the same credential appears on several devices you have signed into with the same account. This is the closest thing to automatic backup, and for many everyday accounts it is enough. The limits matter: sync normally follows one vendor's ecosystem, and if you lose access to that underlying account, you may lose the synced credentials with it. Confirm which keychain a given passkey actually lives in before assuming it is safe.

Exportability

Some passkeys can be exported or transferred between managers, and some cannot. Whether export is supported depends on the platform and the credential, so treat "can I move this?" as a question to test, not one to assume. Where export is not offered, moving an account to a new setup means registering a fresh passkey rather than copying the old one.

A second enrolled credential

This is the part you fully control. Registering a second passkey — on another device or on a hardware security key — for the same account gives you a second way in that does not depend on sync or export at all. It is a real, independent credential rather than a copy that may or may not exist elsewhere, which is why it is the most reliable form of backup.

Why register a second device or a hardware security key

If an account has only one enrolled passkey, losing the device that holds it can lock you out until you work through a slower, sometimes manual account-recovery route. Registering a second credential now turns the loss of one device into an inconvenience instead of an emergency.

On the accounts that matter most — your primary email, the password manager itself, financial accounts, and the cloud account that holds your synced passkeys — a second method is worth the few minutes it takes. A hardware security key is a strong choice for that second method: it is small, portable, and independent of any single phone or laptop. A second phone or tablet works too, as long as it is a device you would still have if the first one were lost.

Why recovery codes belong off the device

An account's recovery codes are the fallback when a passkey is not available. If those codes are stored only on the device that holds the passkey, then losing that device loses both at once — exactly the moment you need the codes. Keep them somewhere separate: a printed copy in a locked place, or in a password manager whose own recovery path you trust.

If you store codes in a password manager, check first that the manager is reachable without the very device or credential you might lose, and review its own recovery setup in advance. The wider trade-offs of keeping passkeys and a manager together are covered in password managers with passkey recovery and passkey vs password manager first.

The account-by-account inventory

Backup is easier to reason about one account at a time than as a vague general worry. Work through this list once, then revisit it after any change of phone, laptop, or key.

1. List the accounts where you have enrolled a passkey, starting with the ones that would hurt most to lose: primary email, the password manager, financial accounts, and the cloud account behind your synced passkeys.
2. For each account, open its security settings and count the enrolled passkeys and other sign-in methods — password, authenticator app, hardware key, backup codes.
3. Mark any important account that has only one way in.
4. Register a second method wherever the count is one.
5. Note where each account's recovery codes are kept, and confirm they are not only on a device you could lose.
6. Repeat the check after you retire or replace a device.

When the only enrolled device is gone

If the single device holding a passkey is lost, stolen, or wiped, stay calm and work in order:

• If the platform syncs passkeys and you can still sign into that platform account on a new device, the credential may reappear there. Check that first.
• Otherwise, use the account's own recovery flow from a device you still control, starting with a recovery code or an alternative sign-in method registered on the account.
• If nothing works, check whether the service offers an account-recovery process that uses proof of ownership, and expect it to involve a wait.
• Once you are back in, register at least two methods before you sign off, so the same problem cannot simply repeat.

The full step-by-step version of this situation lives in what to do when the phone is gone, and sign-in quirks that block the recovery flow are collected in passkey troubleshooting.

Checklist

• Know which keychain each important passkey lives in — synced, local-only, or on a hardware key.
• Every critical account has at least two sign-in methods.
• A hardware security key or a second device is enrolled where the account supports it.
• Recovery codes are stored off the device that holds the passkey.
• You have checked that your password manager is reachable without the device you might lose.
• You can name, from memory, which single account would hurt most to lose — and you have a second method on it.

Where to go next

• Lost phone: recovery walkthroughWhat to do, in order, when the only enrolled device is gone.
• Passkey troubleshootingWhen sign-in or credential removal does not behave as expected.
• Password managers with passkey recoveryKeeping passkeys and a manager together, safely.
• Password-manager comparisonA broader look at how the options differ.

Last updated: 2026-10-16