Lost your phone? What happens to your passkeys (2026)

Synced or device-bound: where your passkeys live

Whether you get a passkey back depends on where it was saved, not on the phone. Microsoft’s help page draws the line clearly. A device-bound passkey “is stored only on the specific device where it was created and it does not sync to other devices or the cloud.” If you lose that device, “you lose the passkey unless you have another recovery method.” A synced passkey lives in a credential manager or cloud service and follows you between devices.

On a phone, most passkeys are the synced kind. iPhone saves them to iCloud Keychain, and Android usually offers to save them to Google Password Manager. The device-bound kind mostly turns up on Windows PCs and physical security keys.

A thief can’t use the passkeys on your lost phone without getting past its lock screen. Apple’s passkeys team says passkeys need Face ID, Touch ID or the device passcode to decrypt, and “without these, passkeys remain securely stored on the lost device.”

Each system backs up passkeys differently and asks for something different on a new device. This is what each one’s own help page said as of October 2026.

Where the passkey is saved	Synced?	What you need on a new device	If every device is gone
iCloud Keychain (iPhone, iPad, Mac)	Yes, end-to-end encrypted	Apple Account password, a code, then an old device’s passcode or a trusted device to approve	Recoverable through Apple’s escrow or a recovery contact
Google Password Manager (Android, Chrome)	Yes, encrypted	Your Google Password Manager PIN, or the screen lock of one of your Android devices	Recoverable if you know that PIN or screen lock
Microsoft Password Manager (Edge on Windows)	Yes, Windows desktops only	Your Microsoft Password Manager PIN, with 10 tries	Recoverable with the PIN
1Password and similar managers	Yes, backed up to your account	Account password plus Secret Key	Recoverable; keep your Emergency Kit safe
Windows Hello on one PC	No	Not possible	Lost; use the site’s account recovery
Hardware security key	No	Not possible	Lost; use a backup key or account recovery

iPhone: getting your iCloud Keychain back

If you still have another Apple device, this is easy. Apple says a new device joins your iCloud Keychain by being approved from an existing device, and your passkeys sync across.

If you lost your only Apple device, Apple’s escrow service can still hand back your keychain. Apple can’t read what’s in it. To recover, Apple says you sign in with your Apple Account password, answer a text message sent to your registered phone number, then enter your old device passcode. You get 10 attempts. After several misses the record locks and you must call Apple Support. After the tenth, Apple destroys the escrow record.

Notice the catch in that sequence. The text goes to your phone number, so get a replacement SIM from your carrier first if your number lived in the lost phone.

The safety net is a recovery contact. Apple’s page says you can add up to five trusted people, and they get no access to your account. They can only give you a recovery code. Set one up under Settings > [your name] > Sign-In & Security > Recovery Contacts, as of October 2026. If you use Advanced Data Protection, a recovery contact or recovery key is also how you reach your encrypted iCloud data on a new device.

Android and Chrome: Google Password Manager

Google syncs passkeys saved in Google Password Manager to your Google Account. On a new device you open them with one of two things, per Google’s Chrome help:

your Google Password Manager PIN, which Chrome asks you to create the first time you save a passkey on a computer, iPhone or iPad;
the screen lock (PIN, pattern or password) of an Android device that already had your passkeys.

That second option surprises people. You don’t need the lost phone in your hand. You need to remember the PIN, pattern or password that opened it. If you forget the PIN, Google says you can reset it from a device where you’ve already used a passkey: in Chrome, go to Google Password Manager > Settings > Change Google Password Manager PIN.

Windows Hello, security keys and third-party managers

These three behave very differently, so check which one you used.

Windows Hello passkeys stay on one PC. Google’s Chrome help is blunt: “If you save passkeys to Windows Hello, you can’t recover them if your computer is lost or the operating system is reinstalled.” Windows can now sync passkeys another way. Since November 2025, Microsoft Password Manager in Edge 142 and later saves passkeys to your Microsoft account. You open them on a new Windows device with a Microsoft Password Manager PIN, and you get 10 tries. Microsoft’s announcement said this sync covered Windows desktops, not phones, and not work or school (Entra) accounts. Its help page, checked in October 2026, still says Microsoft Password Manager is rolling out and works only in Edge 142 and newer with a personal profile.

Hardware security keys aren’t backed up. Per Google’s help, if you lose or reset the key, you can’t recover the passkeys on it. Register a second key as a spare.

1Password treats a saved passkey like any other item in your vault, and its lost-device page says your data “is automatically backed up and available online in your 1Password account.” To get it back, install 1Password on another device and sign in. The same page says to regenerate your Secret Key and deauthorize the lost device on 1Password.com, then store the new Emergency Kit it gives you somewhere safe.

Lost a passkey but not the account

Losing a passkey doesn’t close the account behind it. Apple’s passkeys team put it plainly in 2023: “The recovery method is independent of the authentication mechanism.” Sites keep their usual recovery options, like a reset link sent by email, and you can make a new passkey once you’re back in.

Your email account matters most here, because most other resets go through it. Google’s help says to keep a recovery phone number and recovery email up to date, and to store backup codes for when you can’t use your phone. If your number was hijacked rather than lost with the phone, read someone asked for my Google Voice verification code.

Are passkeys safer than passwords?

Yes. In April 2026 the UK’s National Cyber Security Centre, part of GCHQ, stopped recommending passwords wherever passkeys are available. It said a new technical report shows passkeys are “at least as secure as, and generally more secure than” the strongest password paired with two-step verification. The reason is phishing. A passkey only works on the site it was made for, so a fake login page can’t collect it. Microsoft’s help gives the example that a passkey made for netflix.com can only be used with netflix.com.

They also do less damage in a breach. Apple notes that the website stores only a public key, which isn’t secret, while the private key never leaves your devices. One-time codes sent to your phone, by contrast, can be caught by a scammer. Our guide to whether *#21# shows if your phone is hacked explains how call forwarding scams catch verification calls.

The real trade-off is recovery, which is why this page exists. A synced passkey is only as safe as the account it syncs through. Protect your Apple, Google or Microsoft account with strong recovery options and you keep the security while cutting the lockout risk. If a company has told you your data leaked, see what to do after a data breach notice letter.

What to do next

Check where your passkeys live. On iPhone, look in the Passwords app. On Android or Chrome, open Google Password Manager. For any account whose only passkey sits in Windows Hello, add a second passkey saved to a synced manager.
Keep your Google Password Manager PIN somewhere safe, and remember the screen lock of every Android phone you’ve used it on. On iPhone, know your old passcode.
Add an Apple recovery contact (Settings > [your name] > Sign-In & Security > Recovery Contacts), and a Google recovery phone, recovery email and backup codes.
If you use a hardware key, register a second one. If you use 1Password, keep your Emergency Kit somewhere safe.
If your phone is already gone, ask your carrier for a replacement SIM, mark the phone as lost or erase it with Apple’s or Google’s find-my-device tools, and sign in on the new device to pull your passkeys back.

What happens to your passkeys if you lose your phone?