Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you lose the phone that holds a passkey, or lose a FIDO2 security key, first determine whether the credential was synchronized or stored only on that device. Try another enrolled passkey, backup code, recovery method, or the sign-in page’s “Try another way” option before starting account recovery.
A synchronized passkey may return when you sign in to the same credential manager on a replacement device. A device-bound passkey or hardware key does not transfer automatically, so you need another registered authenticator or the account provider’s recovery process. After you regain access, revoke the missing credential, secure a stolen phone and its number, and register independent backups.
Start with this five-minute triage
1. Check whether the phone is lost or merely unavailable
If the phone may still be nearby, try unlocking it and confirm that a screen lock is enabled. Google says a passkey on a device may not work when screen lock is disabled. At a sign-in prompt, choose Try another way to return to the account’s other available options: Google’s passkey guidance.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Cross-device sign-in can also fail without Bluetooth, an internet connection, or proximity between the devices. Microsoft lists Bluetooth being off, devices being out of range, and either device being offline as troubleshooting causes: Microsoft’s passkey troubleshooting guide. These conditions can make a valid passkey appear to be missing.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Use every method already enrolled
Look for another passkey on a different phone or computer, a second security key, backup codes, a verification code, a prompt on another trusted device, a recovery email or phone, or a previously trusted computer. The exact choices depend on the service and what you set up earlier. Google specifically lists verification codes, Google prompts, backup codes, another added security key, and a registered computer as possible alternatives for some 2-Step Verification accounts: Google’s lost-key recovery guidance.
Do not assume that a newly purchased security key will solve an active lockout. It can serve as a backup only after it has been registered while you still have access, or after the provider restores your account.
3. Identify where the private credential was stored
A passkey is an authentication credential based on FIDO standards, as the FIDO Alliance explains. Its private key can be synchronized by a credential manager, kept in a single device’s authenticator, or stored in an external FIDO2 security key. That storage choice determines whether a replacement device can recover it.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What happens with each type of passkey?
| Storage type | Does it transfer automatically? | Best next step | Main dependency |
|---|---|---|---|
| Synced credential manager | Usually, after the same manager account is restored on the replacement device | Install or enable the credential manager, sign in, and complete its security checks | Access to the manager account and its recovery factors |
| Device-bound passkey | No; it remains on the lost or damaged device | Use another enrolled authenticator or the website’s account-recovery process | A separate registered method or verified ownership |
| FIDO2 security key | No; the private key stays in that physical key | Use a second registered key or another sign-in method, then remove the missing key | Another authenticator or provider recovery |
| Work or school account | Depends on administrator policy | Contact the organization’s help desk or identity administrator | Configured enterprise recovery options |
Microsoft recommends synchronized storage when it fits your needs and creating passkeys on additional devices when credentials are stored locally. Its explanation of passkeys also notes that a passkey provider can be an operating-system or browser manager, a third-party application, or an extension: Microsoft’s passkey explainer. Convenience across devices therefore comes with dependence on the account that protects the credential manager; local storage gives tighter device control but requires you to prepare separate backups.
Restore a synchronized passkey on a replacement phone
- Secure the replacement device. Update its operating system, set a strong screen lock, and enable the credential manager you used before.
- Recover the manager account first. Sign in with its password, recovery key, trusted number, recovery email, or other required factor. If you cannot recover this account, the synchronized passkeys protected by it may remain inaccessible.
- Wait for synchronization to complete. Open the manager and verify that the expected passkey appears before removing anything from the old account.
- Test the passkey at the service’s sign-in page. Use the account’s passkey option and confirm that the replacement device can unlock the credential.
- Register an independent backup. Add a second phone, another computer, or a FIDO2 security key so the replacement device is not your only route.
Apple documents a special iCloud Keychain recovery path even when all associated devices are lost. Its procedure requires Apple Account authentication, an SMS sent to the registered number, and the device passcode. Apple states that the escrow recovery process allows ten authentication attempts; after the limit is reached, the escrow record is destroyed. Several failed attempts may require Apple Support to grant additional attempts. Follow the current instructions at Apple’s passkey security documentation rather than repeatedly guessing. Apple also describes a recovery contact who can help with Apple Account access if you forget the password or device passcode.
Recover when the passkey was device-bound or on a lost key
There is no private-key copy to download from a device-bound authenticator or hardware security key. Sign in with another passkey, a spare key, a backup code, or another method offered on the account’s sign-in screen. If none works, the account provider must verify that you own the account and issue a recovery path.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep the missing key or phone listed until you have confirmed that another method works, then remove the credential associated with it. Removing a credential too early can eliminate the only method that still functions.
Recommended Free Tools
Use the account provider’s recovery process when nothing works
Personal Google accounts
Use Google’s account-recovery flow and answer its ownership questions as accurately as possible. Google may request an email address or phone number where it can reach you. For a Google account protected by 2-Step Verification, Google says recovery can take 3–5 business days when no other second step is available. That estimate applies to the stated Google scenario, not to other websites or account providers: Google Account Help.
Apple Accounts
Use Apple’s current account and iCloud Keychain recovery instructions. Have the registered phone number and device passcode available if the recovery flow requests them. Because Apple’s ten-attempt escrow limit is consequential, stop guessing when the interface warns about remaining attempts and use the support route described in Apple’s documentation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft personal accounts
Try another sign-in method shown by Microsoft, then follow its account-recovery prompts if no authenticator remains. Bluetooth, internet access, and device proximity can affect a cross-device attempt, so resolve those conditions before declaring the passkey lost. Microsoft’s troubleshooting steps are at its passkey support page.
Work and school accounts
Contact your organization’s IT or identity administrator. Administrators can restrict which passkey types are allowed and whether self-service recovery is available. Microsoft Entra documents an account-recovery capability for users who lose all registered authentication methods, but each organization configures its own availability and process: Microsoft Entra account recovery.
What to do immediately after you regain access
- Remove the missing passkey or key. In the account’s security settings, open the passkeys or security-keys list, identify the lost device by its label or date, and revoke it.
- Review active sessions and devices. Sign out the lost phone, browser, or computer wherever the provider offers that control.
- Check other credential stores. If a credential still appears after removal, it may also exist in a third-party credential manager; review that manager separately.
- Protect a stolen phone. Use the platform’s locate, lock, or erase feature when available. Ask your mobile carrier to transfer the number to a replacement SIM or phone and to protect the account against unauthorized changes.
- Replace recovery details if necessary. Update a compromised recovery email address, phone number, password, or backup-code set.
- Add at least one independent authenticator. Register a second passkey on another device or a spare FIDO2 security key, then test it in a private sign-in session.
For Google accounts, the passkey and security-key controls are available after signing in on an accessible device. Google also provides controls for signing out a lost Android device and reviewing sessions: Google’s passkey guidance.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Choose a recovery setup before the next loss
| Setup | Convenience | Failure scenario | Preparation |
|---|---|---|---|
| One device-bound passkey | High on that device | Loss of the device leaves no transferable copy | Register another device before an emergency |
| Synced passkeys | High across supported devices | Loss of the manager account or its recovery factors blocks synchronization | Secure the manager account and maintain recovery access |
| Primary plus spare FIDO2 keys | Moderate; requires carrying or storing a key | Both keys are lost or neither was registered | Register two keys and store the spare separately |
| Passkey plus backup codes | Moderate | Codes are lost, exposed, or already used | Generate a fresh set and store it away from the phone |
- Register a second passkey on a different device where the service permits it.
- Add a second FIDO2 security key to important accounts before the primary key disappears; keep the spare in a secure, separate location.
- If you use device-bound passkeys, create digital spares on other devices. If you use synchronization, protect the manager account as carefully as the accounts inside it.
- Verify recovery email addresses and phone numbers periodically, and keep backup codes accessible but protected.
- Never create a passkey on a shared or public device, and keep screen locks enabled.
- Store backup credentials independently of the phone they are intended to replace.
Common mistakes and how to avoid them
Assuming every passkey is cloud-backed
Synchronization is a property of the credential manager and account configuration, not of the word “passkey” itself. A hardware key and many device-bound credentials cannot be restored from a website.
Deleting the only working method
Do not revoke a phone or key until another method has successfully completed a sign-in. Keep a working session open while you add and test the replacement authenticator.
Trying to bypass provider verification
A passkey authenticates you; it is not a universal account-recovery service. Each relying service decides what evidence is sufficient when every authenticator is gone. Follow that service’s official recovery flow and provide consistent ownership information.
Confusing a phone-number transfer with passkey recovery
Moving your number to a new SIM can restore SMS-based verification, but it does not copy a device-bound passkey or a hardware key. Treat number recovery and credential recovery as separate steps.
Quick Recap
A practical decision path
- Can you unlock the original phone? Fix screen-lock, Bluetooth, range, or connectivity issues and try again.
- Is another passkey, key, code, prompt, recovery email, or trusted computer available? Use it and then revoke the missing credential.
- Was the passkey synchronized? Recover the credential-manager account on the replacement device and verify synchronization.
- Was it device-bound or on external hardware? Skip attempts to “download” it; use another enrolled method or account recovery.
- Is the account managed by an employer or school? Contact the administrator because policy determines the available recovery options.
- After recovery, have you added an independent backup? Register and test it before closing the incident.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
