Passkey Setup: How to Create, Use, and Recover Passkeys Safely

Good passkey setup takes only a few minutes, but the choices you make during setup affect how easily you can sign in later. Passkeys remove the need to type a password, yet they still depend on your phone, computer, account recovery options, and sometimes a password manager. This guide explains how passkeys work, how to create one on common devices, and what to check before deleting your old password.

What a Passkey Does Differently

A passkey is a pair of cryptographic keys created for a specific website or app. Your device keeps the private key. The service stores a related public key. During sign-in, the service checks that the two match without receiving your private key.

That design fixes several common password problems. A website can’t expose your passkey in a database breach because it never receives the private half. You also don’t have to invent, remember, or reuse a long password. Signing in usually means approving a prompt with Face ID, Touch ID, a fingerprint, a device PIN, or a screen lock.

Passkeys don’t make every account threat-proof. Someone who can unlock your phone may be able to approve a sign-in. A stolen recovery email account can still be used to take over some services. Fake login pages can also trick you into giving away other account details, even if the passkey itself is resistant to ordinary password phishing.

Think of a passkey as a sign-in credential protected by your device’s local security. That protection is strong, but account recovery still deserves attention.

Before Passkey Setup, Check These Details

Start on the official website or app for the account. Don’t create a passkey from a link in an unexpected email or text message. If you received a sign-in alert, open the service using a bookmark or by typing its address yourself.

Then check four things:

• Your device lock works. Set a screen lock, PIN, fingerprint, or face unlock before creating the passkey.
• Your operating system is supported. Update your phone, tablet, or computer if the service says your software is too old.
• You can still access account recovery. Confirm your recovery email, phone number, backup codes, or another approved method.
• You know where the passkey will be saved. It may go into Apple Passwords, Google Password Manager, a supported third-party password manager, or the device’s local credential store.

That last item matters if you use several devices. During passkey setup, a credential saved only on your phone might not appear on your work computer. Some services let you create more than one passkey, so you can register a phone, a laptop, and a hardware security key separately.

Passkey Setup on an iPhone or iPad

Apple devices generally save passkeys through the built-in password system when iCloud Keychain is enabled. The wording varies by service, but the path usually looks like this:

1. Open the official app or website and sign in with your current password.
2. Open Account, Security, or Sign-in and security settings.
3. Choose Passkeys, Add passkey, or a similar option.
4. Approve the prompt with Face ID, Touch ID, or your device passcode.
5. Give the passkey a recognizable name if the service asks for one, such as “Personal iPhone.”

On a newer iPhone, the passkey should be available the next time you sign in to that service. iCloud Keychain can make it available on other Apple devices using the same Apple Account, provided those devices meet the service’s requirements.

Don’t assume that every Apple device will have the same sign-in experience. A Mac may offer Touch ID, a device passcode, or a QR-code option for approving the sign-in from your iPhone. If the account appears in the Passwords app, inspect its passkey entry there before removing anything.

Passkey Setup on Android

On Android, passkeys are commonly stored through Google Password Manager or another password manager that supports them. The labels differ by phone maker and Android version, but the process is similar:

1. Sign in to the service’s official app or website.
2. Open its security or account settings.
3. Tap Create a passkey or Add passkey.
4. Confirm your identity with your fingerprint, face unlock, PIN, or pattern.
5. Review the storage location before accepting the prompt.

Your passkey may sync to other devices signed in to the same Google Account. If you use a third-party password manager, check that it is selected as an available passkey provider in your phone’s settings. Otherwise, Android may save the credential somewhere different from your usual password vault.

Test the new sign-in while you are still signed in on the original device. Open a private browser window or use another device, enter the account’s email address, and select the passkey option. This test tells you more than seeing a “passkey created” message. You want to confirm that the credential can actually be found and approved.

Using a Passkey on a Different Computer

You don’t have to create a separate passkey for every computer. A service may let you approve a sign-in with a phone that already holds the passkey. Look for options such as Use another device, Use a phone or tablet, or a small QR-code icon.

Choose that option on the computer. Scan the QR code with your phone, then approve the request. Keep the phone nearby and make sure Bluetooth is enabled if the prompt asks for it. The phone and computer often need to be close enough to confirm that the request is happening locally.

This method is handy on a shared or temporary computer because it leaves the passkey on your phone rather than saving it to that machine. Don’t approve a request you didn’t start. A surprise passkey prompt may mean someone is attempting to sign in to your account.

Should You Delete Your Password?

Usually, no. Create and test the passkey first, then leave the password available until you understand the service’s recovery process.

Some services let you remove the password and require passkeys from that point forward. That can reduce password-based attacks, but it also removes a familiar fallback. If your passkey is stored on one phone and that phone is lost, recovery may take longer than expected.

A safer sequence is:

1. Create the passkey.
2. Sign out and test it on the same device.
3. Test it from another device or browser.
4. Confirm that your recovery email, backup codes, and other sign-in methods work.
5. Only then decide whether removing the password is worth the trade-off.

For a high-value account, create a second passkey on a separate device or hardware security key before removing the password. Store backup codes somewhere offline, such as in a secure home file or printed document. Avoid keeping the only copy in the account you might be locked out of.

How to Find and Remove Old Passkeys

Account security settings usually show a list of registered passkeys. Each entry may include a device name, creation date, or last-used date. Review this list after changing phones, selling a laptop, or losing a tablet.

Remove entries tied to devices you no longer control. If a phone was stolen, use the account’s security page from another trusted device and delete its passkey. Also use the phone maker’s device-finding service to lock or erase the missing device when appropriate.

Be careful with duplicate entries. One phone can show several passkeys if you created one through different browsers or password managers. Delete a credential only after confirming that another passkey or recovery method works. Removing the wrong entry won’t usually damage the account, but it can leave you with fewer ways to sign in.

If you’re cleaning up several accounts, a password manager can help you keep login details and recovery information organized. For guidance on sharing account access without exposing every credential, see this guide to password manager sharing for family logins.

What to Do If the Passkey Doesn’t Appear

Start with the simple checks. Confirm that you’re using the same email address, browser profile, and password manager account used during creation. On a phone, check that screen lock and the passkey provider are enabled. On a computer, try the browser that originally created the passkey.

If the passkey is on another device, choose the cross-device sign-in option instead of entering a password repeatedly. Keep both devices nearby, turn on Bluetooth, and approve the prompt only after checking the website name.

Some services have separate accounts for personal and work email addresses. A passkey belongs to the specific account where you created it. It won’t automatically sign you into a second account just because both use the same phone.

If nothing works, use the service’s official account recovery process. Don’t delete every existing sign-in method while troubleshooting. Once access is restored, review the passkey list and create a replacement on a device you control.

Passkey Safety Rules Worth Following

• Create passkeys only from the real service website or official app.
• Keep your phone, computer, and password manager protected with a strong device lock.
• Register a second sign-in method for accounts you can’t afford to lose.
• Save backup codes somewhere separate from the account and phone.
• Remove passkeys from devices you sell, donate, or permanently lose.
• Never approve an unexpected passkey prompt.
• Review account recovery settings after creating the passkey.

Passkeys reduce the burden of password hygiene, but they don’t remove the need for account hygiene. Your recovery email, device lock, and registered devices still form part of the security picture.

Final Verdict

Passkeys are a better default than passwords for most personal accounts, especially when you save them in a trusted password manager or synced device system. Create one, test it on a second device, and keep a recovery method before removing your password. That small setup routine prevents the most common lockout problems while giving you stronger protection against password theft.

Frequently Asked Questions