A passkey is a sign-in credential built from a cryptographic key pair. If the device holding it is lost or stolen, what happens next depends on whether the passkey syncs through a provider, is tied to that device alone, or has a separately registered backup. Local device authentication adds a barrier, but it does not make an account invulnerable: recovery and fallback sign-in methods still matter.
How a passkey signs you in
When you create a passkey, your device or security key creates a public and private key pair for a particular website or app. The authenticator keeps the private key; the service registers the public key. The service does not receive or store your private key.
As an Amazon Associate I earn from qualifying purchases.
At sign-in, the service sends a challenge. After you unlock the authenticator—usually with a device PIN, fingerprint, or face recognition—it uses the private key to sign that challenge. The service checks the signature against the public key it has on file. Because the sign-in uses a fresh challenge rather than a reusable password, the service’s database does not contain a password that can simply be replayed. Apple Developer, Google for Developers, and Microsoft Learn describe this public-key sign-in model.
A biometric prompt is local verification, not a transfer of your biometric data to the website. Google says biometric material stays on the personal device, and Microsoft says biometrics used for Windows passkey authentication are not sent to the service.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why passkeys resist ordinary phishing
A passkey is associated with the identity of the app or website where it was registered. The browser or operating system mediates the sign-in, so a credential registered for the real service is not simply handed to a lookalike phishing page. This prevents a common password and one-time-code attack: tricking someone into typing a reusable credential into a fraudulent site.
Apple describes this site binding by saying, “Passkeys are intrinsically linked with the app or website they were created for, so people can never be tricked into using their passkey to sign in to a fraudulent app or website.” That is Apple’s explanation of the design, not a guarantee that every part of every account is secure.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Passkeys are phishing-resistant, but the whole account workflow matters. FIDO Alliance’s 2025 paper says both synced and device-bound passkeys are phishing-resistant, while warning that relying parties get stronger phishing prevention when they remove phishable authentication routes. A service that still permits a weaker fallback or recovery route may leave an attacker another path into the account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Synced and device-bound passkeys are different
| Type | Where the credential is available | What device loss means | Trade-off |
|---|---|---|---|
| Synced | Backed up and made available on supported devices through a passkey provider account. FIDO Alliance describes syncing as end-to-end encrypted; Google says passkeys are encrypted before syncing and supports compatible third-party providers on Android 14 or later. | After restoring access to the provider on another supported device, the passkey may be available there. Availability depends on the provider and device compatibility. | More convenient across devices, but dependent on the provider account, its supported platforms, and the service’s recovery options. |
| Device-bound | Stored on one physical device or FIDO2 security key; it does not sync to other devices or the cloud. | The credential itself is unavailable if that device or key is lost. You need another credential registered with the service or must use its recovery process. | Creates a stricter device boundary, but requires a backup plan for loss or damage. |
Synced does not mean available everywhere: provider support varies by operating system, browser, device, and service. Check which provider holds the passkey and which devices it supports before relying on cross-device access. The service must also support passkeys in the first place.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A physical FIDO2 security key is optional; it is not required to use passkeys. It can be useful when you want a device-bound credential or stricter device control. Microsoft recommends security keys in some highly regulated or elevated-privilege Entra environments, while describing synced passkeys as a convenient, lower-cost option for most users outside those environments. That is Microsoft Entra guidance, not a universal requirement. A security key only helps with services that support it, and it does not by itself restore access to an account.
What to do if a passkey device is lost or stolen
First identify whether the credential was synced or device-bound. With a synced passkey, restoring access to the provider account on another supported device may restore access to the credential. With a device-bound passkey, you need a second credential already registered with that service or the service’s recovery process. Google says people who lose or break their phone can use legacy authentication or Google’s account recovery; other providers and services have their own procedures.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Passkey sign-in requires local authentication to unlock the private key. That is an additional barrier, not proof that a stolen device is harmless. The platform guidance does not establish a blanket safety guarantee for a stolen device.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Use the device maker’s lost-device controls. Use the platform’s available tools to locate, lock, or erase the missing device.
- Secure the account for the passkey provider. If you suspect someone may access that account, follow the provider’s account-security and recovery steps.
- Review important services. Check their recovery options and active sessions; revoke sessions or remove the missing device’s credential where the service allows it.
- Restore or recover access. For synced credentials, sign in to the provider on a supported replacement device. For a device-bound credential, use a separately registered passkey or the service’s recovery method.
Choose a passkey setup with a recovery route
Before creating a passkey for an important account, check the following:
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- Storage: Is the passkey synced by a provider or bound to one device or key?
- Compatibility: Which devices, operating systems, browsers, and services work with that provider?
- Backups: Can you register a second passkey, such as one on another device or a FIDO2 security key?
- Recovery and fallback: What happens if you cannot use the passkey, and does the service permit weaker sign-in routes?
- Control versus convenience: Do you need a strict device boundary, or is access across supported devices more useful?
For most people, the practical choice is not simply “passkey or no passkey.” It is choosing a provider and service combination that fits the devices they use and setting up a backup or recovery route before they need it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
