Passkeys have gone mainstream, and the numbers say they work: the FIDO Alliance’s Passkey Index 2026, published in October, found passkey sign-ins succeed 93% of the time versus 78% for traditional MFA. What most guides skip is the part that actually goes wrong: where your passkey lives, and what happens when that device is gone.
This guide gives you the setup steps for Google, Microsoft and the two biggest third-party password managers, in the order that matters most, plus a backup plan so a lost phone does not become a lost account.
Why bother now
A passkey replaces a password with a cryptographic key pair. The private half stays on your device or in your password manager and is unlocked with your face, fingerprint or device PIN. There is nothing to type into a fake login page, which is why passkeys shut down the credential-phishing attacks that passwords and one-time codes are exposed to. We covered the wider threat picture in understanding modern cyber threats.
Adoption has crossed into the mainstream. The FIDO Alliance estimated in May 2026 that about 5 billion passkeys are in use, and its State of Passkeys survey of 11,000 consumers in ten countries found 75% had enabled at least one. The Passkey Index puts passkeys at 36% of successful sign-ins among participating services in 2026, up from 26% a year earlier, and says they save an average of 27 seconds per sign-in.
First decide where your passkeys will live
This is the decision that determines whether you can recover from a lost device. Every passkey is stored in one of four places:
| Where it’s stored | Syncs to your other devices? | If you lose the device | Best for |
|---|---|---|---|
| iCloud Keychain (Apple) | Yes, across Apple devices | Recoverable through iCloud Keychain recovery, even if you lose every device | People fully on iPhone and Mac |
| Google Password Manager | Yes, via your Google Account | Available again once you sign in to your Google Account on a new device | Android and Chrome users |
| Third-party manager (1Password, Bitwarden) | Yes, wherever the app runs | Available again once you sign in to the manager on a new device | Mixed Apple, Windows and Android households |
| Device-bound (Windows Hello, hardware security key) | No | Gone, unless you have another sign-in method | A backup, or high-security accounts |
Our recommendation: pick one synced manager as your main home for passkeys, and add one passkey somewhere else for your most important accounts. If you use both an iPhone and a Windows PC, a third-party manager saves you from splitting passkeys across two ecosystems.
One caveat on switching later. Moving passkeys between managers is still patchy: 1Password’s help page, for example, says passkey export currently works only from its iOS and Android apps. Choose carefully now rather than planning to migrate.
Set up in this order
Start with the accounts that can reset everything else. Your primary email account is the master key to every “forgot password” link you own.
1. Your Google Account
- Go to myaccount.google.com/signinoptions/passkeys and sign in.
- Select Create a passkey, then confirm. Unlock your device with your fingerprint, face or PIN when asked.
- To store one on a hardware security key instead, choose Create a passkey and then Use another device.
- Repeat on each device where you want a passkey. On iPhone, iPad and Mac, Google says iCloud Keychain needs to be switched on.
Signing in on a computer that doesn’t hold the passkey: enter your username, choose Try another way, then Use your passkey. Scan the QR code with your phone, keep Bluetooth on, and approve on the phone. Steps are from Google’s passkey help page.
2. Your Microsoft account (Outlook.com, Xbox, Windows)
- Go to account.live.com/proofs/manage (Advanced security options) and sign in.
- Choose Add a new way to sign in or verify, then Face, Fingerprint, PIN, or Security Key.
- Pick where to save it: a password manager, your phone (you will scan a QR code), a security key, or Windows Hello on this PC. Use Save another way if the default location isn’t the one you chose above.
Note that a Windows Hello passkey stays on that one PC. Microsoft’s own guidance in its create and save a passkey page lists synced managers as an option, and that is the safer choice for most people. Edge can also upgrade saved logins to passkeys automatically; the switch is under Settings, Passwords and autofill, Microsoft Password Manager.
3. Your password manager as the passkey home
Bitwarden: in the browser extension, open Settings, then Notifications, and tick Ask to save and use passkeys. On iPhone, set Bitwarden as a provider under Settings, then the AutoFill Passwords and Passkeys option. On Android, set it as the passkey provider in your autofill settings. Bitwarden syncs passkeys to every device where you use it.
1Password: when a site offers to create a passkey, 1Password prompts you to save it, either into the existing login item or as a new one. Next time, choose Use passkey at sign-in.
4. Then the money and identity accounts
Banks, payment apps, shopping accounts and anywhere with your saved card come next. Not all of them support passkeys yet, and support varies by country. Where they don’t, keep a strong unique password in your manager plus app-based two-factor authentication.
The lockout-proof checklist
Run through this once your main accounts are done. It takes ten minutes and prevents the most common passkey horror stories.
- Two passkeys for every critical account. One in your main manager, one in a second place: another ecosystem, another device or a hardware key.
- Keep recovery details current. Google says adding a passkey doesn’t change or remove your other recovery options, so make sure your recovery phone and email are still yours.
- Apple users: know your recovery path. Apple’s passkey security page says iCloud Keychain recovery needs your Apple Account password, a code to your registered phone number and a device passcode, and the escrow record is destroyed after 10 failed attempts. Consider setting an account recovery contact.
- Add before you remove. Microsoft advises creating the new passkey on a replacement device first and deleting the old one afterwards.
- Lost a device? Sign in from another device and remove that device’s passkey from the account straight away.
- Deleting a passkey from your manager doesn’t remove it from the website. 1Password warns about this; clean up both sides.
- Shared accounts need a plan. A passkey stored in one person’s phone can’t be shared like a password. Put shared logins in a shared vault in your password manager instead.
Verdict
Set up passkeys on your email account this week, and store them in a synced manager rather than on a single device. The security gain is real and the convenience is noticeable. The only way passkeys hurt you is if you treat them as a single key with no spare, so make the spare part of the setup, not an afterthought. If you’re comparing managers to hold them, our guide to choosing the right cybersecurity software covers what to look for.
