What 2026's Passkey Changes Mean If You Lose Your Phone

Since Google Play services 26.21, dated June 1, 2026, Android phones can move passkeys between Google Password Manager and other password managers, using the FIDO Credential Exchange standard that Apple's iOS 26 and macOS 26 already support. For you, that means you can now choose which provider holds your passkeys, and whose recovery rules you depend on, but only while you still have the device. Once a phone or laptop is lost, nothing can be exported from it.

After a loss, your passkeys come back only if they were synced and you can give the provider the secret it asks for. Passkeys that lived only on the old device are gone. For context, the web standard behind passkeys, WebAuthn Level 3, became a final W3C Recommendation on August 25, 2026, but it changes how websites handle passkeys, not what your phone or provider does after a loss.

Key takeaways

Synced passkeys come back on a new device only after you supply your provider's secret: the passcode of an Apple device you used before, a Google Password Manager PIN or old Android screen lock, a Microsoft Password Manager PIN, or your password manager's sign-in details or recovery key. Apple documents a limit of 10 attempts, and so did Microsoft's November 2025 launch post.
Passkeys saved to Windows Hello, a Chrome profile on a Mac or a hardware security key are not backed up. Losing the device means creating new passkeys site by site.
Passkey transfers built on the FIDO Credential Exchange standard (Apple's version 26 systems, and Android since Google Play services 26.21, dated June 1, 2026) move passkeys between apps on a device you still have. They can't bring back passkeys from a device you've lost.
With no backup, every account falls back to its own recovery method, and most of those lead through your email inbox. Protect your email account's recovery before anything else.

What it means for you

iPhone and Mac users. Your passkeys sync through iCloud Keychain. To restore them, you'll need your Apple Account password, a reply to a text sent to your registered phone number and the passcode of an Apple device you used before. Recovering the Apple Account alone doesn't restore them. See "What each provider asks for."
Android and Chrome users. Passkeys in Google Password Manager sync to your Google Account. A new device will ask for the screen lock of your old Android phone or your Google Password Manager PIN. A forgotten PIN can be reset only on a computer, iPhone or iPad where you've already used Google Password Manager; otherwise the last resort deletes all your passkeys.
Windows users. Passkeys in Windows Hello stay on that PC only. Passkeys saved through Microsoft Password Manager in Edge sync and ask for a separate PIN on a new device.
Third-party password manager users. Your passkeys come back as soon as you can sign in to the password manager on the new device. Keep its emergency details, such as 1Password's Emergency Kit or a Dashlane recovery key, somewhere that doesn't depend on the phone.
Switching phones on purpose. Credential Exchange can move passkeys between managers before you switch. See "Moving passkeys is not a backup."
Hardware security key users. A key can't be backed up or copied. Register at least two on every account that uses one, where the site allows it.

Synced vs device-bound passkeys

A passkey is a pair of cryptographic keys: the website keeps the public key, and your device or password manager keeps the private key. It replaces the password for that site.

The FIDO Alliance, the industry group behind the standard, describes two kinds. Synced passkeys are copied between your devices through a cloud service. Device-bound passkeys never leave a single device, as on a hardware security key.

The difference decides what a lost device costs you. FIDO says that when you set up a new device with the same passkey provider, your synced passkeys are there and ready to use. With a device-bound passkey, the site has to fall back to some other way of confirming it's you. The standard itself, WebAuthn Level 3, warns that losing a device generally means losing the credentials bound to it, which can lock you out if that was your only credential for an account.

Passkeys saved in Apple Passwords or in Google Password Manager on Android are synced. Device-bound passkeys turn up in places people often forget.

Google's Chrome help lists three. Passkeys saved to Windows Hello can't be recovered if the computer is lost or Windows is reinstalled. Passkeys saved to a Chrome profile on a Mac can't be recovered if the computer is lost or the profile is deleted. Passkeys on security keys aren't backed up at all.

What each provider asks for

A synced passkey isn't automatically a recoverable one. The backup is encrypted so that the company storing it can't read it, which means the new device has to prove it's you with a secret only you know. Forget that secret and the backup is as good as gone. The table summarizes each provider's own documentation, checked October 3, 2026.

Where the passkey is saved	Backed up?	What a new device asks for	Documented limits
Apple Passwords (iCloud Keychain)	Yes, end-to-end encrypted	Apple Account password, a reply to a text sent to your registered phone number, and the passcode of an Apple device you used before	10 attempts; locked after several failures until Apple Support grants more; destroyed after the 10th failure
Google Password Manager on Android	Yes, to your Google Account	The PIN, pattern or password of your old Android phone, or your Google Password Manager PIN	Android 9 or later with a screen lock on
Google Password Manager in Chrome (computer, iPhone, iPad)	Yes, to your Google Account	Your Google Password Manager PIN (or an Android screen lock)	PIN resets only on a computer, iPhone or iPad where you've used Google Password Manager; the last resort deletes all passkeys
Microsoft Password Manager in Edge	Yes, to your Microsoft account	Your Microsoft Password Manager PIN	10 attempts (November 2025 launch post); PIN resets only from a trusted device
Windows Hello, saved to this PC	No	Nothing to restore; create new passkeys	Lost if the PC is lost or Windows is reinstalled
1Password, Bitwarden, Dashlane	Yes, in your vault	Your password manager's own sign-in details (1Password also needs your Secret Key)	Bitwarden can't reset a forgotten master password; Dashlane recovery works only if set up in advance, and a passwordless account recovers only with a recovery key
Hardware security key	No	The key itself	A lost or reset key can't be recovered

Apple: account recovery is not keychain recovery

Apple's passkey security page (September 16, 2024) says passkeys can be recovered through iCloud Keychain escrow even if all your devices are lost. You sign in with your Apple Account and password and respond to a text sent to your registered phone number. Then, in Apple's words, "the user must enter their device passcode." It allows "only 10 attempts."

Apple's Platform Security guide (May 7, 2024) describes the same step differently: "users need to enter their iCloud security code." The two pages don't conflict. Apple's keychain recovery page explains that "if two-factor authentication is turned on," the device passcode is used, while a separate iCloud security code is created only when two-factor authentication isn't set up. Because Apple requires two-factor authentication for any account using iCloud Keychain, passkey users are asked for a device passcode.

The same guide says that after several failed attempts the record locks until Apple Support grants more, and after the 10th failure the keychain "is lost forever." Getting back into your Apple Account doesn't bring the keychain with it. Apple's iCloud data security overview (January 5, 2026) says passwords and keychain data are always end-to-end encrypted and that Apple "can't help you recover this data." Only your device passcode or password, a recovery contact or, if you set one up, a recovery key can.

Google: the PIN or the old screen lock

Google's Android passkey help says you recover passkeys on a new phone by signing in and entering the PIN, pattern or password of the lost one. Saving passkeys there requires Android 9 or later with a screen lock turned on. On a computer, iPhone or iPad, creating your first passkey also creates a Google Password Manager PIN, six digits by default according to Google's September 2024 announcement.

Google's PIN help says a forgotten PIN can be reset only "from a non-Android device on which you've previously used Google Password Manager." If no such device is left, the last resort is to reset your passkeys at passwords.google.com, which "deletes all your passkeys," so you'd create new ones for each site.

Microsoft: Edge sync vs Windows Hello

Passkey sync in Microsoft Password Manager started rolling out in Edge 142 on Windows on November 3, 2025, for personal accounts, with "a maximum of 10 attempts" to enter the PIN on a new device. A later April 22, 2026 engineering post mentions only "a fixed limit on consecutive incorrect attempts," and says a locked-out PIN is reset from a trusted device. Microsoft's Edge passkeys page, which carries no date, now says passkeys sync across Windows, iOS and Android, for both personal and Entra ID work or school accounts; it doesn't mention macOS.

Passkeys saved to the PC itself are a different matter: Microsoft's saved-passkeys guide says you'll need to add new passkeys after the device is replaced. Windows 11 also accepts third-party passkey managers, which you switch on under Settings > Accounts > Passkeys > Advanced options.

Third-party password managers

Your passkeys are only as recoverable as the password manager account. 1Password's Emergency Kit holds the sign-in address, email and Secret Key you need on a new device. Bitwarden keeps passkeys encrypted in your vault, but it can't reset a forgotten master password.

Bitwarden's fallbacks are a hint, emergency access, a device you're still logged in on, a passkey set up for logging in to Bitwarden, or administrator recovery for business accounts. If none of those works, the only option is a new account.

Dashlane says it can't tell you a forgotten Master Password or help you log in, and its account recovery options work only if you turned them on in advance; without one, you may need to reset your account, which erases all your data. For a passwordless Dashlane account, the only option is an account recovery key, a code you generate ahead of time. Using the key also takes a code from your email or authenticator app, so if you can reach neither your email nor an authenticator app, for example because the authenticator was only on the lost phone, the key won't work.

Day one on a replacement phone

Illustrative example; the accounts and their recovery options are hypothetical. Someone uses passkeys on 20 accounts, all stored on one phone, and the phone is lost. Their email account is separate from those 20.

The fallback mix is assumed: 10 accounts still have a password that can be reset by email, 5 sign you in with an email link, 3 accept saved backup codes, and 2 need a support review that takes longer than a day (10 + 5 + 3 + 2 = 20).

Situation on the new phone	Accounts available on day one	Passkeys to create again, eventually
Passkeys synced, and you know the old passcode or provider PIN	20 of 20 (100%)	0
No usable backup, backup codes saved, email works	18 of 20 (90%): 10 + 5 + 3	20
No usable backup, no backup codes, email works	15 of 20 (75%): 10 + 5	20
No usable backup, and the email account can't be recovered on day one either (its only passkey was on that phone)	3 of 20 (15%) with saved codes, 0 without	20

The numbers show two lessons. First, sync turns the loss into a single sign-in step. Without it, you have 20 separate recoveries and 20 new passkeys to create. Second, your email account is the hinge: losing it drops day-one access from 18 accounts to 3 with saved codes, and from 15 to 0 without them, because 15 of the 20 recoveries send a link or code to your inbox.

"No usable backup" also covers synced passkeys whose old passcode or PIN you can't supply, which is why the secret matters as much as the sync setting.

When there is no backup

If the only copy of a passkey is gone, the site that issued it decides how you get back in. The WebAuthn standard asks sites to let you register more than one credential, and it says sites with single-device passkeys should make sure each account has another way in or a recovery process. Not every site does. Work through the accounts in this order:

Your email account first. Use its own recovery options, such as a recovery phone, recovery email or saved backup codes. Most other recoveries depend on it.
Then each account, using the site's other sign-in options. Choose "Try another way" or "Forgot password" on the sign-in page. A password, email code, text code (if your number has moved to the new phone) or backup code may still work.
Create a new passkey as soon as you're in. Save it to a synced provider this time.
Remove the old passkey from the account. For a Google Account, Google's passkey help says to sign in on a device you can still use and remove the passkey from the lost device.

If someone else may have used your accounts, treat it as a hacked-account recovery instead, which follows different steps.

Moving passkeys is not a backup

The FIDO Alliance's Credential Exchange standard lets you move passkeys from one password manager to another. FIDO's specifications page lists the Credential Exchange Format (CXF) 1.0, which defines the data, as a Proposed Standard with errata dated March 9, 2026. The Credential Exchange Protocol (CXP), which defines the transfer itself, is listed as a Working Draft dated October 3, 2024.

Platforms are already shipping transfers based on it:

Apple. At WWDC 2025, Apple said passkeys can be transferred between participating credential manager apps on iOS, iPadOS, macOS and visionOS 26. The transfer is started by you, runs directly between apps, is confirmed with Face ID or similar, and creates no files on disk.
Google. Google's system release notes list import and export of passwords and passkeys between Google Password Manager and third-party managers in Google Play services 26.21, dated June 1, 2026. Google's import and export help describes this flow on Android phones. On a computer, its help page describes only a passwords .csv download.
Third-party apps. Dashlane's Credential Exchange guide (updated September 29, 2026) lists Apple Passwords, 1Password and Bitwarden as participating apps on iOS, and 1Password, Bitwarden and Google Password Manager on Android. Version requirements vary: Dashlane says iOS 26 or macOS 26 on Apple devices and Android 10 or later with the latest Google Play services, 1Password exports passkeys only from its iOS (26 or later) and Android (14 or later) apps, and Bitwarden lists iOS 26 or later and Android 14 or later.

Every one of these transfers runs between two apps on a device you're holding and signed in to. That makes them useful before a loss, for example when you're moving from an iPhone to an Android phone and want your passkeys in a manager that works on both. Once the device is gone, they can't help. Microsoft's Edge passkey pages don't mention Credential Exchange.

Frequently asked questions

Does reinstalling Windows delete my passkeys?

Passkeys saved to Windows Hello, yes. Google's Chrome help says they can't be recovered once the operating system is reinstalled, because they exist only on that PC. Passkeys kept in Microsoft Password Manager, Google Password Manager or a third-party manager return once you sign in again and pass that provider's check.

Can I change my Google Password Manager PIN on an Android phone?

No. Google's PIN help page says Android has no option to create or change the PIN, because Google Password Manager on Android uses the phone's screen lock instead. The PIN is created on a computer, iPhone or iPad, and a forgotten one can be reset only on a non-Android device where you've already used Google Password Manager.

Can a website tell whether my passkey is backed up?

Yes. WebAuthn Level 3 defines two flags, Backup Eligibility and Backup State, that tell the site whether a passkey can be synced and whether it's currently backed up, and it recommends that sites store them. If a passkey stops being backed up, for example because you turned sync off, the standard says the site should walk you through adding another credential if you don't already have one.

Can I keep a backup file of my passkeys?

Only with some managers. Bitwarden's export guide says JSON exports include stored passkeys, offers encrypted JSON options and warns against storing unencrypted exports. 1Password says exports from its desktop apps leave passkeys out. Dashlane says passkeys can't be exported to CSV or backed up in DASH files.

Can I use my phone's passkeys on a new or borrowed computer?

Yes, if the phone still works. On the computer's sign-in page, choose the option to use a passkey from another device and scan the QR code with your phone. Google's Chrome help notes that the passkey stays on the phone and isn't copied to the computer.

Before you lose a device

Find where your passkeys live. Check Apple Passwords, Google Password Manager, your third-party manager and Windows (Settings > Accounts > Passkeys). Move any passkey stored only in Windows Hello or a Chrome profile into a synced manager, or add a second passkey for that account.
Write down the secret your provider will ask for and keep it away from the device: the passcode of a current Apple device, your Google or Microsoft Password Manager PIN, your 1Password Emergency Kit, your Bitwarden master password or your Dashlane recovery key.
Keep a second signed-in device. Google resets a forgotten PIN only on a computer, iPhone or iPad where you've used Google Password Manager, and Microsoft only from a trusted device, so an old laptop or tablet can save you.
Register two hardware security keys wherever you use one. Apple's security key setup requires at least two and warns that losing all your trusted devices and keys could lock you out permanently.
Save backup codes for your email account and other important accounts, printed or in a second location.
Confirm sync is on. Sign in on a second device and check that a recently created passkey appears there.