What Happens to Passkeys If You Lose Your Phone, and What to Do

If you lose your phone, you usually don't lose your passkeys with it. Most passkeys are synced, meaning they are backed up to your Apple account, Google account, or password manager and come back when you sign in on a new phone. Device-bound passkeys live on one device only, so they disappear with it, and you will need a backup way into those accounts.

This guide covers what happens to passkeys if you lose your phone, what to do in the first hour, and the backups that stop a lost phone from turning into lost accounts.

What happens to passkeys if you lose your phone: synced vs device-bound

A passkey replaces a password when you sign in. Instead of typing anything, you approve it with your face, your fingerprint, or your screen lock. If the idea is new to you, start with our plain-English guide to passkeys.

Synced passkeys

A synced passkey is saved to an account, such as your Apple account, your Google account, or a password manager that supports passkeys. That account copies it to your other signed-in devices.

If your phone disappears, the passkey is still in that account, ready to come back on a new phone. That is why most people lose nothing when they upgrade.

The tradeoff is that your passkeys are only as reachable as the account that holds them. If you are locked out of that account, you are locked out of them too.

Device-bound passkeys

A device-bound passkey stays on one device and cannot be copied off it. Hardware security keys work this way. These are small keys you plug in or tap against your phone. Some passkeys set up by apps and workplaces are device-bound too.

That makes them very hard to steal, but if the device is gone, so is the passkey.

The first hour after your phone is lost or stolen

Work through these steps in order. Being quick matters more than being perfect.

1. Try to find it. From another device or a web browser, use Find My for an iPhone or Find Hub (formerly Find My Device) for an Android phone.
2. Mark it as lost. This locks the screen and can show a number where you can be reached. On iPhone, it also suspends Apple Pay.
3. Call your mobile carrier. Ask them to suspend your line so no one else gets your text-message codes, and order a replacement SIM.
4. Secure your key accounts. If the phone was stolen or someone may know your passcode, change the passwords for your email and your Apple or Google account. Check for sign-ins you don't recognize, and tell your bank.
5. Erase it if it is not coming back. Erasing protects your data, but on some phones it also stops you from tracking it. If you think a thief knows your passcode, erase it right away.

Erasing the phone does not touch your synced passkeys, because they stay in your account. You don't need to delete them from websites either, and doing so would stop them working on your other devices. Keep the lost phone listed in Find My or Find Hub so you can keep tracking it.

How to recover passkeys on a new phone

If your passkeys were synced

1. Sign in to the same Apple or Google account, or to the password manager that holds your passkeys. A sign-in code may be texted to your number, so get your replacement SIM working first.
2. If asked, enter your old phone's passcode or screen lock, or approve the new phone from another device you are signed in on.
3. Make sure password and passkey syncing is turned on.
4. Sign in to a site where you use a passkey to check that it works.

Step 2 is needed because synced passkeys are usually end-to-end encrypted: only your own devices can unlock them, not the company storing them. Remember your old passcode for a while after you replace a phone.

If a passkey lived only on the lost phone

1. Sign in another way: a second passkey, a security key, a recovery code, a code from an authenticator app, or a text code once your new SIM works.
2. Add a new passkey on your new phone, usually in the account's security settings.
3. In those settings, delete the old passkey, but only if you know it lived on the lost phone.

With no other way in, you will need that company's account recovery process. It can take days and may ask you to prove who you are, and the backups below help you avoid it.

Can a thief use passkeys on a stolen phone?

Not just by holding it. A passkey won't work without your face, fingerprint, or screen lock, and it only works on the real site it was made for, so a scam page can't trick it out of you. Our passkey vs password guide explains why, and the FIDO Alliance, the industry group behind passkeys, has an overview.

The real risk is a thief who knows your passcode. On most phones the passcode is the backup for Face ID or a fingerprint. Someone who watched you type it can often use your saved passkeys and passwords, and may try to take over your Apple or Google account.

To make that much harder:

• Use a passcode of at least six digits, not four.
• Cover the screen when you type your passcode in public, and use Face ID or your fingerprint so you type it less often.
• On iPhone, turn on Stolen Device Protection in your passcode settings. Away from familiar places, it requires Face ID or Touch ID, with no passcode fallback, to use saved passwords and passkeys. It also makes anyone wait an hour before changing your Apple account password.
• On many Android phones, turn on Theft protection in Settings. It can lock the screen if someone snatches the phone and runs.

Passkey backups to set up before it happens

Think of these as a spare house key left with someone you trust. Start with your most important accounts: your email, your Apple or Google account, your bank, and your password manager.

A second device or security key

• A second device. A tablet or computer signed in to the same Apple or Google account usually has your synced passkeys too. For device-bound passkeys, add a separate passkey on that device.
• A hardware security key. Add it to each important account while you can still sign in, then keep it somewhere safe at home. Not every site accepts security keys, so keep another backup too.
• An authenticator app that isn't only on your phone. These apps show a new six-digit code every 30 seconds. If yours can back up its codes or run on a second device, turn that on.

Recovery codes stored somewhere safe

Recovery codes, sometimes called backup codes, are one-time codes a service gives you for times when your usual sign-in is gone. Many services let you print or download a set.

Keep them on paper somewhere safe at home, such as a fireproof box, and don't keep your only copy on the phone you might lose. A family emergency binder works well, as long as the binder itself is kept somewhere secure.

Also check your recovery phone number and email. On iPhone, consider adding a recovery contact: someone you trust who can help you get back into your Apple account.

What this means for your password manager

Your password manager holds the keys to everything else, so give it its own lost-phone plan. Many password managers give you a recovery file or codes, so keep a copy somewhere other than your phone.

Pinzen is the family password manager we make. Your vault is protected by a master phrase you create, and we cannot see or reset it. That is why setup includes a Recovery Kit, a complete spare key: with Face ID, a passkey, an authenticator code, or one of its one-time codes, it can reset a forgotten phrase.

If your phone goes missing, your ways back in are the Recovery Kit, another trusted device, or optional Google email recovery. Google email recovery is easier, but it is labeled as a security tradeoff. To sign in, you can use a passkey (including a hardware security key), Google, or a one-time email link, and there is no account password to forget.

On the free plan, your private vault lives on one trusted device at a time, so if that device is your phone, the Recovery Kit is your spare. Pinzen+ adds automatic sync across devices and lets you approve a new device with a short code.

If you turn on extra-secure recovery, the Kit alone cannot reset your phrase. It also needs a passkey or an authenticator app, so make sure one of those is on something other than your phone.

For more detail, see our security page and our guide to master passwords vs passkeys. When you're ready, you can create a free Pinzen vault in three steps, and saving your Recovery Kit is one of them.

Frequently asked questions

What happens to my passkeys if I get a new phone?

Synced passkeys come back when you sign in to the same Apple account, Google account, or password manager on the new phone, though you may need your old phone's passcode. Device-bound passkeys stay on the old phone, so sign in another way and add new ones. If you are upgrading, keep the old phone until you are done.

Can someone use my passkeys if they steal my phone?

Not without getting past your phone's lock, because every passkey needs your face, fingerprint, or screen lock. The real risk is a thief who watched you type your passcode. Use a longer passcode, cover the screen in public, and turn on Stolen Device Protection on iPhone or Theft protection on Android. If they might know your passcode, erase the phone remotely.

How do I recover passkeys after losing my phone?

For synced passkeys, sign in to your Apple account, Google account, or password manager on a new device, and they should reappear. For a passkey that lived only on the lost phone, sign in with a backup such as a security key or recovery code, then add a new passkey. Without a backup, use the service's account recovery process.

Should I have more than one passkey for important accounts?

Yes. Give your email, your Apple or Google account, your bank, and your password manager at least two ways in. That could be synced passkeys plus a hardware security key, or a passkey plus printed recovery codes. Many sites let you add several passkeys, and adding a second one usually takes about a minute.