Lost Your Phone: What Actually Happens to Your Passkeys

Losing the phone is the easy part. The awkward part is not knowing which credentials went with it. Whether you have a problem comes down to one design difference — and whether you still hold a second way into each account.

Synced or device-bound: the distinction that decides everything

• Synced passkeys. The key is stored in a platform account — the one behind your phone's operating system or your password manager — and appears on other devices signed into it. Your phone is one copy among several, so the credential survives and waits elsewhere.
• Device-bound passkeys. The key is created inside one piece of hardware and is not designed to be copied out of it. A security key is the obvious example; some phones in some configurations act as one. Lose the device and the credential is gone: the account survives, the proof of who you are does not.

How to check which one you have

Open the passkey or security-key list in the site's security settings and read how each entry is named, then check your phone's password settings for wording like stored in your account, versus on this device only. Anything described as a security key or hardware is device-bound.

The first hour

1. Restore access first, clean up later. The instinct is to sign in somewhere and delete the lost phone. If that credential was your only route in, doing so first makes the problem permanent.
2. Try the cheapest route. A synced passkey works on any device signed into the platform account. A device-bound one means reaching for printed recovery codes, a backup security key, or an authenticator app on another device.
3. Use your backup now, not tonight. A backup factor you have never exercised is only a theory, and this is a poor hour to find out it was never registered.
4. Decide whether the phone is a real risk. A locked handset with a strong passcode is not the same as one that was unlocked, had no passcode, or held your SMS second factor. For the second kind, change passwords and revoke sessions from a trusted device.
5. Only then remove the old credential. A passkey that cannot be reached cannot be used, so leaving the handset listed is not an emergency. Remove it as cleanup once you are back in, and sooner if the phone was unlocked or off to a repair shop.

The first week

• Re-register a passkey on the new device for each account that lost one, starting with email and whichever account holds your other recovery routes.
• Add a second passkey. Two devices, or a device plus a hardware key, turn the next lost phone into an inconvenience.
• Start the slow recoveries early. Some services will not let you register a new passkey without an existing factor, and recovery can take days.
• Close the loose ends. If your old number carried one-time codes, update it and prefer a factor not tied to a SIM, and drop the lost handset from trusted devices.

If the rebuild stalls — a re-registration refused, a prompt that never appears — try the troubleshooting sequence before calling it a platform bug.

Removing the device is not the same as deleting the credential

• The device entry is your platform or service saying "this handset is trusted". Removing it is a permission change.
• The credential is the key pair registered at the site: a private half on your side, a public half held by the service. That record lives at the service regardless of trusted status.

So removing the phone from a device list can leave the passkey record at the site untouched, and deleting the passkey in the site's settings does nothing about trusted status elsewhere. When you mean both, do both. With a synced passkey, deleting the credential can also remove it from every device signed into the platform account.

What an attacker can and cannot do with your locked phone

The answer depends on how the phone was set up, and you can check.

Blocked by design

• Reading a device-bound key out of the hardware and using it elsewhere. The key is designed never to leave the chip, and a locked device is designed not to release it — only rely on that if your phone has a passcode and modern secure hardware.
• Using a synced passkey on the attacker's own device without your platform account password and its second factor.
• Logging in with the passkey from a fake page. A lookalike can still steal a password typed into it, but not the passkey itself.

Realistic risks

• One-time codes by SMS to the lost number. If that number is your second factor, whoever holds the SIM receives the codes. Switch that account to another factor.
• Anything reachable from an unlocked phone. If the handset unlocks easily, or is unlocked when found, whoever holds it can sign in with the passkey and read your apps. Against someone holding your unlocked phone, a passkey is close to a formality.
• The recovery loop. If the phone was your only second factor and the recovery codes are gone too, the person locked out may be you.

The durable fix is the same as anywhere else on this site: a second passkey, recovery codes off the device, and a recovery path that does not depend on one handset. Passkey backup and recovery covers that setup; passkeys versus a password manager first covers where they should live.

Scenario, what survives, what to do

Scenario	What survives	Next action
Synced passkey, phone lost, platform account reachable	The passkey, on any signed-in device	Sign into the platform account on a laptop and use the passkey
Synced passkey, platform account also unreachable	Nothing until that account is recovered	Start that recovery now; it takes days
Device-bound key — a security key, or phone as one	Nothing; the credential went with the hardware	Get in with another factor or site recovery, then register a new passkey
Phone also held your SMS one-time codes	The passkey; not the codes	Change the number; prefer a factor not tied to a SIM
Phone remote-wiped before you recovered anything	Synced credentials if the platform account is intact; device-bound keys are not	Recover the account, then re-register on each site
Phone turned up days later, still locked	Whatever the lock protected was never exposed	Sign in, check the device list, keep your second passkey

Last updated: 2026-10-16

Working phone, different problem? If the passkey arrived with a work SSO rollout, what to do when your employer forces passkeys through SSO covers the day-one steps.