Where Are Your Passkeys Stored and Will They Survive a Lost Device?

Passkeys are replacing passwords on a growing number of websites and apps. They are easier to use, resistant to phishing, and protected by the same face scan, fingerprint, or PIN that unlocks your device.

This storage question now affects billions of credentials. The FIDO Alliance estimated in its 2026 report that 5 billion passkeys were active worldwide.

Yet one important question is often left unanswered. Where is the passkey actually stored?

The answer depends on the option selected when the passkey was created. It may be synced through Apple Passwords, Google Password Manager, Microsoft Password Manager, 1Password, or Bitwarden. It may instead remain tied to Windows Hello, a local Chrome profile, a phone, or a physical security key.

That choice determines whether the passkey can appear on a replacement device or disappears with the original hardware.

The Short Answer

A synced passkey can normally survive the loss of one device. Its credential provider keeps protected encrypted data that can become available on another supported device after you regain access to the provider account.

A device bound passkey remains with one authenticator. That authenticator may be a computer, phone, or physical security key. If it is lost, damaged, or reset, the passkey stored there cannot normally be restored.

Losing a passkey does not always mean losing the account. You may still have another registered passkey, a password, a recovery code, or an account recovery process. The safest setup prepares one of those alternatives before anything goes wrong.

How Passkey Storage Works

When you create a passkey, your device or credential provider creates a cryptographic key pair for that particular account and service.

The website stores the public key and a credential identifier. The public key is not secret and cannot be used by itself to sign in as you.

The corresponding private key is managed by the authenticator or credential provider you selected. When you return to the website, its server sends a fresh challenge. Your authenticator asks you to approve the request, usually with a face scan, fingerprint, device PIN, or password. It then signs the challenge, and the website verifies that signature with the public key.

The private key is not sent to the website. Your biometric information is also used locally to approve access and is not supplied to the website as a login secret.

This design is why a stolen website database does not reveal a reusable passkey secret. It is also why the location of the private credential matters so much.

Synced Passkeys and Device Bound Passkeys

A synced passkey is protected by a credential manager and made available across supported devices through an encrypted synchronization service. The provider controls how a new device is approved and how encrypted passkey data is recovered.

A device bound passkey does not sync through a provider account. It stays with the authenticator where it was created. A passkey stored in Windows Hello is bound to that computer. A passkey stored on a physical security key is bound to that key.

Both types protect against phishing. The main difference for an everyday user is portability and recovery. Synced passkeys offer convenience and redundancy. Device bound passkeys offer stronger control over where the credential can exist, but require a separate recovery plan.

Passkey Storage at a Glance

The name of the browser does not always tell you where a passkey lives. The provider selected during creation is what controls sync and recovery.

Apple Passwords and iCloud Keychain

On supported Apple devices, passkeys saved in Apple Passwords are stored and synchronized through iCloud Keychain when Passwords and Keychain sync is enabled.

Apple says this data is protected with end to end encryption. Approved devices signed in to the same Apple Account can receive updated passwords and passkeys without Apple being able to read their contents.

If you lose one Apple device, the passkeys should remain available on another approved device. When setting up a replacement device, you may approve it from an existing trusted device or use the iCloud Keychain recovery process.

Recovery is not unconditional. Apple documents several checks that may be required, including access to the Apple Account, a trusted phone number, and a previous device passcode. An account recovery contact can provide another path if one was configured in advance.

Turning off iCloud Keychain changes how credentials remain available. Apple says password and passkey information can remain locally on that device, but it will no longer receive updates from other devices. Check the Passwords and Keychain setting before assuming a passkey is synchronized.

Apple does not document a general iCloud web page that displays and uses your passkeys. On a supported non Apple device, a website may instead let you choose a passkey from a nearby iPhone or iPad by scanning a QR code and approving the request on that device.

Google Password Manager

A passkey deliberately saved in Google Password Manager is stored with your Google Account and protected with end to end encryption. It can be used across supported Android devices and Chrome browsers signed in to the same Google Account.

On a new environment, signing in to the Google Account is only part of the process. Google says the encrypted passkeys may also need to be unlocked with a Google Password Manager PIN or an Android device screen lock credential.

That extra secret helps prevent Google from reading or using the private credential. It also means your recovery plan should include more than remembering the Google Account password. Keep your Google Password Manager PIN available, and maintain access to a trusted Android device where appropriate.

A passkey created through Chrome or Android is not automatically proof that it lives in Google Password Manager. The save prompt may offer another password manager, Apple Passwords, Windows Hello, or a physical security key. Its recovery behavior follows the provider selected during creation.

Microsoft Password Manager and Windows Hello

Microsoft offers both synced and local passkey storage, but the choices should not be treated as interchangeable.

A passkey saved to Microsoft Password Manager can sync through the associated Microsoft cloud account and become available in supported Microsoft Password Manager environments. Availability depends on the current Edge version, profile type, device, and rollout status.

A passkey saved to Windows device or Windows Hello is different. It is stored locally on that Windows computer. Microsoft and Google both document that this option does not provide passkey synchronization or backup. If the computer is lost or the operating system is reinstalled, that passkey cannot be recovered from Windows Hello.

Read the creation prompt carefully. Choosing Microsoft Password Manager provides the synced option where it is available. Choosing Windows device or Windows Hello provides the local option.

Microsoft Authenticator is another separate choice in certain Microsoft work and school account flows. Its availability and storage behavior may be controlled by an organization. Do not assume that a passkey in Microsoft Authenticator is a cloud copy of a passkey stored in Windows Hello.

Local Passkeys Created Through Chrome

Chrome can display passkey prompts without being the provider that ultimately stores the credential. The result depends on the operating system and the choice made in the prompt.

On macOS, Chrome can save a passkey in the local Chrome profile when that option is selected. Google says this local passkey is protected by the macOS Keychain, but it is not synchronized to other environments. It cannot be recovered if the computer is lost or the Chrome profile is deleted.

On Windows, a local passkey offered through Chrome is generally stored with Windows Hello. It remains on that computer and does not become part of Google Password Manager merely because Chrome was used to create it.

Chrome browser sync should therefore not be treated as a backup for every passkey created in Chrome. Open the relevant credential manager and confirm where the passkey appears.

Passkeys in 1Password and Bitwarden

Third party password managers can provide a useful option for people who regularly move between Apple, Android, Windows, and other supported environments.

A passkey saved in 1Password becomes part of the relevant 1Password item. It can be used through supported 1Password apps and browser extensions after you regain access to the vault on a new device.

A new device may require your 1Password account details, including the account password and Secret Key, depending on how the account is configured. Keep the Emergency Kit secure and review any family, team, or account recovery options before relying on the vault as your only access path.

Passkey export support in 1Password is not the same across devices. Its current documentation says mobile apps can export passkeys, while exports made through desktop apps do not include them. If moving away through a desktop export, you may need to create new passkeys at each website.

Bitwarden stores passkeys in encrypted vault items. A cloud hosted or properly maintained private Bitwarden vault can synchronize those items to another signed in device.

Bitwarden includes stored passkeys in JSON exports, but its documentation warns against treating exported passkeys as a long term backup. An exported credential can contain a signature counter that becomes outdated as the active credential is used. A website may reject that older exported copy.

Export and migration features are improving, but they are not universal substitutes for another registered credential.

Physical Security Keys

A physical security key stores device bound passkeys inside the key itself. The private credential does not sync to a cloud account and cannot normally be copied out as a backup.

The passkey is bound to the security key, not to the computer where you use it. You can carry the key between compatible computers and phones. Losing your laptop does not destroy a passkey that remains on the security key.

Losing or resetting the security key is different. The passkeys stored on it cannot be downloaded to a replacement key.

A spare security key is therefore not a duplicate containing copied passkeys. It must be registered separately with each important website. The website then has two independent credentials for your account. If one key is lost, the other can still be used.

Support for multiple passkeys varies by service, so confirm that the second key works before storing it somewhere safe.

If Your Phone Is Lost

A passkey synced through Apple Passwords, Google Password Manager, 1Password, or Bitwarden can normally become available on another compatible device after successful provider recovery.

A passkey stored only on that phone will not survive the loss. You will need another registered credential or the recovery process offered by the website.

If Your Computer Fails

Passkeys in a synced credential manager should remain available through that provider.

Passkeys stored only in Windows Hello or a local Chrome profile will not survive loss of the computer, deletion of the profile, or a relevant system reset.

If Your Security Key Is Lost

The passkeys on the security key cannot be restored from the key. Your account can still survive if you registered another passkey, kept another security key, or retained an acceptable recovery method.

If Your Credential Provider Account Becomes Inaccessible

Synced passkeys may still exist as encrypted data, but you may be unable to unlock them. Recovery then depends on the provider account and any recovery options configured before the loss.

This is why synced storage reduces the risk of device loss but does not remove the need for account recovery planning.

How to Prepare Before You Lose a Device

A few checks now can prevent a difficult account recovery later.

1. Check where each important passkey is stored. Do not rely on the browser name alone.
2. Add another passkey to critical accounts whenever the website permits it. Store the second credential in an independent place.
3. Save recovery codes offered by important services in a secure location that does not depend on the same phone.
4. Keep trusted phone numbers, recovery contacts, and provider account details current.
5. If you use physical security keys, register a spare key separately and test it before storing it safely.
6. If a device is lost or stolen, remove it from the associated Apple, Google, Microsoft, or password manager account. Review the website security settings and revoke any credential specifically associated with the lost device.
7. Test a new device before erasing or trading in the old one. Confirm that your most important accounts accept the expected passkey.
8. Treat export as a migration feature whose support varies by provider, not as a universal passkey backup system.

The Bottom Line

Where a passkey is stored determines what happens when hardware disappears.

A synced passkey will usually survive the loss of one device if you can recover the credential provider account and use a compatible replacement. A device bound passkey will not survive the loss of its authenticator, although the account may remain recoverable through another registered credential.

For most people, a reputable synced credential manager offers the simplest balance of security and convenience. For sensitive accounts, adding a separately registered security key or another independent passkey can reduce the risk of lockout.

The important step is not choosing one provider for everyone. It is knowing which provider you selected, protecting access to it, and creating another route into accounts that matter.