How to protect your accounts with passkeys

Passkeys can protect your sign-ins from fake login pages. To get started safely, choose where your passkey will live, prepare another way into your account, then create and test it.

This guide uses a personal Google Account, with a Microsoft alternative below. You can use compatible equipment you already own; buying a security key is optional. The instructions were checked against official documentation on 20 October 2026, rather than tested on a live account.

1. Understand what a passkey does

A passkey uses a pair of digital keys. The website keeps the public key; your device or password manager protects the private one. Your fingerprint, face scan or PIN authorises its use. FIDO explains how the two keys work together.

Unlike a password you might type into a convincing fake website, a passkey is matched to the real site. Your fingerprint or face data stays on your device. This makes passkey sign-in resistant to phishing, but it does not make every scam or account attack impossible.

2. Decide where to save it

Before accepting a setup prompt, read the storage location. Two choices can have very different consequences:

• Synced storage: a supporting password manager can make passkeys available on your other supported devices. You must still be able to access that provider.
• Device-bound storage: the passkey stays on one device or security key. Losing it means you need another sign-in route.

For example, Google Password Manager syncs through your Google Account. Access on another device can require its PIN or an Android screen-lock credential. A passkey saved locally with Windows Hello is not automatically synced.

Our recommendation: write down the provider’s name and work out how you would regain access to it. Do not assume recovering a website account also restores the password manager holding its passkey.

3. Prepare your recovery options

Open Google’s recovery settings. Check that your recovery email is accessible and different from your Google sign-in address, and that your recovery phone number is yours and verified. These are Google’s recommended checks.

If you use 2-Step Verification, prepare backup codes on a computer:

1. Open your Google Account and select Security & sign-in.
2. In the sign-in section, open 2-Step Verification and authenticate if asked.
3. Find Backup codes, select Continue, then Get backup codes if none exist.
4. Print or download them. Keep the copy protected somewhere you can reach without your phone.

These single-use codes replace the second verification step, not every recovery check. Creating a replacement set invalidates the old one. Advanced Protection accounts cannot download them.

Ask yourself: “If my phone vanished today, could I actually reach this fallback?” An inaccessible recovery email or codes stored only on that phone will not answer that question.

4. Create and test your Google passkey

Use your own screen-locked device with an up-to-date, supported browser and operating system. Check Google’s compatibility requirements. Avoid shared devices: someone who can unlock yours may access your account.

1. Open Google’s passkey settings and confirm the account.
2. Select Create a passkey, then select it again when prompted.
3. Read the device or password-manager prompt. Stop if you do not understand where it will be saved.
4. Complete the requested fingerprint, face or PIN check.

Adding a Google passkey leaves existing sign-in and recovery methods in place. Keep them during setup. Google says a new passkey may take seven days to become available at sign-in.

Our suggested test: retain your working session and try a separate normal sign-in on supported equipment that can access the passkey. Enter your Google username and follow the passkey prompt. Confirm you reach the correct account before depending on this method.

If it fails, use your existing sign-in route and check the official instructions. Do not delete working methods to force the test.

5. Using a Microsoft account instead?

For a personal Microsoft account, follow Microsoft’s documented setup:

1. Sign in at Advanced Security Options.
2. Choose Add a new way to sign in or verify.
3. Select Face, Fingerprint, PIN, or Security Key.
4. Inspect the proposed storage location. Use Change or Save another way if offered, then complete the prompts.

Storage choices depend on your setup. For work or school accounts, ask IT which options your organisation allows.

When replacing an old method, Microsoft advises adding replacement security information first. Do not remove everything during setup.

6. If your phone is lost or stolen

For Google, try a previously prepared alternative: another signed-in phone, a passkey elsewhere, or an eligible backup code. If none works, use Google’s account recovery. Access is not guaranteed or necessarily immediate.

Once you regain access:

1. For a manually created passkey, open Google’s passkey settings, select the lost credential and remove it.
2. Open your account’s security page, find the device-management section, select the lost phone and sign it out. Review all sessions bearing that device name.
3. Change your Google Account password, as Google recommends after phone loss or theft.

Use Google’s lost-device guidance and device sign-out instructions. Signing an Android device out also removes its automatically created Google passkey.

Your next step: prepare a fallback for one personal account, add its passkey and test it. If the storage or recovery route is unclear, resolve that before relying on it.

This article was created with the help of Sylar AI, built in-house for Sylar Knows.