Passkeys Explained Properly: Where They Are Stored, How They Sync, and How Not to Lock Yourself Out

Passkeys are often described as “passwords without passwords.” That is useful marketing shorthand, but it leaves out the part that matters when you buy a new phone or lose a device:

Where is the passkey actually stored, how does it reach your other devices, and what happens if you lose access to the password manager that holds it?

Understanding those three questions makes passkeys much less mysterious.

What a passkey is

A passkey is based on public-key cryptography.

The service you sign in to stores a public key. The private credential stays in your device or password manager. When you sign in, your device proves possession of the private credential after you unlock it using a PIN, fingerprint, face, or other local authentication.

The important security improvement is that the secret is not typed into the website like a password.

Why passkeys resist phishing

A passkey is tied to the website or app for which it was created.

That makes it much harder for a fake login page to trick you into handing over a reusable credential. There is no password string for the phishing site to collect and replay elsewhere.

Where can a passkey be stored?

The answer depends on the platform and the choice you make during creation.

Passkeys may live in Google Password Manager, Apple Passwords/iCloud Keychain, Windows/Windows Hello, a third-party password manager, a physical security key, or in some cases only on one specific device.

That storage location determines how easily the passkey follows you to another device.

Google Password Manager passkeys

On Android, Google Password Manager can store passkeys and synchronize them securely across supported devices connected to the same Google Account.

Google requires a screen lock for passkey storage on Android.

On a new Android device, you may be able to recover synced passkeys after signing into your Google Account and completing the required security verification.

Passkeys in Chrome

Chrome can use Google Password Manager for passkeys.

A computer can also sign in using a passkey that remains on your phone. When the website offers Use a phone or tablet or Use passkey from another device, Chrome can display a QR code and complete the authentication with the nearby phone.

This is useful when the passkey itself is not stored locally on the computer.

Apple passkeys

Apple stores synced passkeys through its password/keychain infrastructure protected by your Apple Account and device security.

The practical benefit is similar: a passkey created on one supported Apple device can be available on your other devices through the same secure account ecosystem.

Apple’s security documentation also emphasizes recovery mechanisms for encrypted keychain data because losing the only device should not automatically mean losing every saved credential.

Windows passkeys can be different

Windows 11 can save passkeys and protect them with Windows Hello.

A locally stored Windows passkey does not automatically mean that the same credential exists in your Google or Apple password manager.

This is why you should pay attention to the provider shown when you create a passkey instead of clicking through the prompt without reading it.

Third-party password managers change the equation

Modern Android and other platforms increasingly let supported password managers act as passkey providers.

If you already rely on one cross-platform password manager for Windows, Android, iPhone, and Mac, storing passkeys there can simplify cross-device use—provided the service supports the platforms and recovery model you need.

Can you have more than one passkey for the same account?

Often, yes.

Many services let you register several passkeys—for example one in your phone’s password manager and another on a hardware security key.

This can be an excellent recovery strategy.

Do not delete your password immediately just because you created one passkey

Some services allow passkeys alongside passwords. Others are moving toward fully passwordless accounts.

Before removing the old sign-in method, confirm that you have at least two reliable ways to regain access.

That could mean two passkeys in different trusted locations, a passkey plus recovery codes, a passkey plus a security key, or a passkey plus a verified account-recovery method.

What happens if you lose your phone?

If the passkey was synchronized through a password manager, losing one physical phone may not mean losing the passkey.

You can sign into the password-manager or account ecosystem on a replacement device and use its recovery process.

If the passkey existed only on the lost device, recovery depends on the website’s alternative sign-in and account-recovery options.

What happens if you replace your phone?

Before wiping the old phone:

1. Make sure the password manager has finished syncing.
2. Verify that important passkeys appear on another device if possible.
3. Check recovery codes and account-recovery information.
4. Test sign-in to your most important accounts from the new device.

Do not treat the phone migration as complete until those tests work.

Can you accidentally delete a passkey?

Yes.

There are two sides to a passkey relationship: the credential stored by your provider and the registration stored by the website or service.

Deleting one side can make the saved entry unusable or leave a registration that needs to be removed from the account’s security settings.

When cleaning up old passkeys, check both the password manager and the website’s list of sign-in methods.

Passkeys do not eliminate account recovery

They dramatically improve authentication, but people still lose phones, forget account passwords, lose access to email addresses, or get locked out of password managers.

Recovery planning therefore matters more, not less.

A practical passkey strategy

• Use a password manager or ecosystem you trust.
• Register a second passkey or hardware key where supported.
• Keep recovery codes somewhere separate from your main device.
• Keep account recovery email and phone information current.
• Review old device passkeys after replacing hardware.

What not to do

Do not create the only passkey for a critical account on a single device and then remove every other recovery method before you understand how that passkey is backed up. Do not store recovery codes only on the same phone. And do not assume a passkey in one ecosystem automatically exists in another.

The easiest mental model

A password is a secret you know and type.

A passkey is a cryptographic credential held by a device or credential provider and unlocked by you.

The technology removes many password problems, especially phishing and password reuse. But the user still needs to know who holds the credential and how that holder recovers it.

Once you understand that, passkeys stop feeling like magic and start looking like a much better authentication system with a recovery plan you can actually control.

Official references

Google Support — Manage passkeys in ChromeOfficial reference Google Support — Use passkeys on AndroidOfficial reference Apple Support — Secure iCloud Keychain recoveryOfficial reference