Passkeys on more than one device: sync them and keep access

How does a passkey reach your other devices?

A passkey is a digital key for signing in to one service. It is created and managed by a passkey provider: your device's keychain, a password manager or a security key. New to passkeys? Read Setting up your first passkey: questions to answer beforehand.

The FIDO Alliance, which develops the standard, distinguishes two kinds. Synced passkeys are copied, end-to-end encrypted, to all your devices that use the same provider. Device-bound passkeys never leave one device, for example a FIDO security key. The account that does the syncing therefore needs strong protection.

How do you turn on syncing on iPhone, iPad and Mac?

Apple stores passkeys in iCloud Keychain and keeps them up to date on every device signed in to your Apple Account. Apple's requirements: the latest software and two-factor authentication for your Apple Account.

If you turn iCloud Keychain off, your passkeys stay on the device. When you sign out of iCloud, you choose whether to keep or delete them; on a device you are giving away, delete them.

How does it work with Android, Chrome and Windows?

On Android, passkeys are stored in Google Password Manager. Google backs them up and syncs them to every device where you are signed in to Chrome or Android with the same Google Account. Your phone needs Android 9.0 or later and a screen lock.

When you create your first passkey on a computer, you are asked to create a Google Password Manager PIN. According to Google, it helps you recover your passkeys on a new device and protects your encrypted data. On a new device, you unlock existing passkeys with this PIN or with your Android device's screen lock PIN.

Tip: You can reset a forgotten PIN from a device where you have previously used a passkey from Google Password Manager.

On Windows, you can also save passkeys in Windows Hello. Google notes that these are neither synced nor backed up and stay on that computer; if you lose it or reinstall the operating system, you cannot recover them. If you need a passkey on other devices too, save it in a synced password manager.

How do you use the passkey on your phone to sign in on another computer?

A passkey does not have to be on every device. With cross-device sign-in, the computer shows a QR code that you scan with your phone. Bluetooth checks that both devices are close, and the passkey stays on your phone. Apple says this also works with nearby non-Apple devices.

Tip: Turn on Bluetooth on your phone first, as the proximity check uses it. This also lets you sign in on a shared computer without saving a passkey there.

New phone: how do you take your passkeys with you?

Same platform: sign in and let it sync

According to the FIDO Alliance, when you set up a new device with the same passkey provider, your passkeys sync to it. With Google, if you lose an Android phone, you can recover your passkeys on a new device by signing in and entering the lost device's screen lock PIN, pattern or password.

If you lose all your Apple devices, Apple recovers passkeys through iCloud Keychain escrow: you sign in with your iCloud account and password, respond to a text sent to your registered number and enter your device passcode. After the tenth failed attempt, the escrow record is destroyed.

Switching between Apple and Android

Syncing works between devices that use the same passkey provider, so moving from iPhone to Android does not carry your passkeys over by itself. Switzerland's National Cyber Security Centre notes that some systems now support the Credential Exchange Format and Protocol (CXF and CXP) to export passkeys individually and import them elsewhere. Check your manufacturer's help.

The reliable route without exporting: while the old device still works, create a new passkey on the new one for each important account, then remove the old ones. Google notes that a new passkey for your Google Account may take up to 7 days to be offered at sign-in.

For everything else to do before you sell or give away the phone, see Handing over an old phone: back up, check, then sign out.

An example: why Aoife's passkey stayed on her laptop

Fictional example: Aoife in Cork uses an Android phone and a Windows laptop. When an online shop offered her a passkey on the laptop, she saved it with Windows Hello. Later, her phone does not offer that passkey, because Windows Hello keeps it on that one PC. Aoife signs in on her phone the usual way and creates a new passkey there, which goes into Google Password Manager. On the laptop she now signs in with her phone by QR code. For her email account, she adds a security key as a reserve.

Which second way in protects you if something fails?

Syncing helps when you lose a device, not when you lose access to the account that does the syncing. Germany's BSI explains that without backups some services offer other ways to prove your identity; in rare cases only contacting the provider helps. Plan a second way into important accounts:

• A second passkey elsewhere: Google lists your passkeys under ‘Passkeys and security keys’. A service's security settings show whether it accepts several.
• A security key as a reserve: The FIDO Alliance says it can act as a recovery credential if you lose access to all your other devices. As such keys cannot be copied, the BSI recommends a second one.
• An Apple recovery contact: Apple lets you optionally set up an account recovery contact.
• Recovery codes: Keep them away from your devices, as described in Store recovery codes where you can actually reach them.
• A remaining password: The Swiss centre notes that passwords often remain as a fallback. Keep yours strong and unique.

To get ready for a lost phone, see Prepare for losing your phone while you still have it. If you are locked out, use only the service's official recovery route.

Where can you find official guidance in Europe?

Manufacturers decide how syncing works. National cyber security bodies offer independent guidance; Switzerland, which is not in the EU, has its own assessment.