Nearly every passkey explainer covers the same ground: no password to steal, no phishing page that fools it, a cryptographic key pair instead. Granted. The part that matters when you actually switch to passkeys is the failure mode. Your credentials live somewhere, at the bottom of a lake, a laptop that refuses to boot, or or an account you got locked out of. What happens next depends entirely on which kind of passkey you made and where it synced, and those differences are bigger than the setup screens let on.
There are three kinds of passkey, not one
Start with the synced kind, because it is what most people actually have. Synced passkeys are stored by your platform provider. Apple keeps them in iCloud Keychain storage, Google in your Google Password Manager, Microsoft in your Microsoft account, and replicate across all devices signed into that account. So signing in on a new iPhone after the old one drowns works, because the passkey comes down from the cloud with everything else. that’s the design most people get by default and the one all the marketing describes.
Device-bound passkeys live in hardware, typically a FIDO2 stick like a YubiKey, and never leave them. It can’t sync, can’t be exported, and can’t be backed up. If the device is destroyed, so is the credential. The trade is deliberate. almost nothing can copy it, including you.
Third comes the password manager passkey, stored by 1Password, Bitwarden, Proton or Dashlane alongside your passwords. These sync wherever your vault syncs. That includes across ecosystems, which is the one thing platform passkeys refuse to do. An Apple-synced passkey can’t move to Android. A vault passkey can sit on both.
Losing a device with synced passkeys
With Apple or Google sync, the recovery story is the same as your account recovery story. New device, sign in with the account password and second factor, passkeys arrive with your passwords and photos. The weak point isn’t cryptography, it’s the account itself. Say your Apple ID recovery is a phone number on that drowned phone and an email you abandoned in 2019. Your passkeys are exactly as recoverable as that chain allows. Not very. The practical rule is simple: your passkey security is roughly as strong as the recovery path on the account that syncs them. People who lock down their Google account with a security key and printed backup codes have strong passkey recovery. People relying on SMS recovery have SMS recovery.
One more Apple wrinkle is worth knowing. A passkey created on a Mac stays available on other Apple devices but can’t be used from a Windows machine unless you scan a QR code with your iPhone, and that only works for services supporting cross-device sign-in, which most now do but some enterprise portals still don’t.
Losing a hardware key
When the key dies, a device-bound passkey dies with it. Which is why the standard advice is to register two keys and put the second one in a drawer. Services that support passkeys let you register multiple ones for exactly this reason, yet the majority of people register one, because the second registration is annoying on day one and priceless on the bad day. Spare FIDO2 keys cost roughly the same as a phone case and serves the same purpose: insurance for the object you actually depend on.
The account lockout nobody plans for
The scenario that catches even careful people isn’t hardware failure, it’s losing the account that holds the passkeys. Your passkeys sync through iCloud, so if your Apple ID is disabled for a billing dispute or a compromise lock, every passkey behind that account is unreachable until the account is restored, and account restoration can drag on for days. Arguably this is the strongest argument for putting your most important passkeys, bank and primary email especially, in a password manager vault whose recovery you control separately from any one platform account. Two independent stores beat one convenient one.
What services themselves do about it
Every service that enables passkeys still has to answer the question of what to do when you show up with nothing. Most keep a fallback: a password, a one-time email code, an SMS, or printed recovery codes generated at setup. That fallback is now the weakest link. An attacker who can’t touch your passkey will simply trigger the email-code fallback instead, and a passkey on an account whose fallback is an old Yahoo password is security theatre. When a site offers passkeys, take a minute to look at what else still signs you in, and shut down the fallbacks you don’t need.
Some services go further and offer a printed one-time recovery code at passkey setup, similar to the codes crypto exchanges and password managers issue. Treat those codes like a one-use password. Print those codes, file them with your important documents, and it is probably the thing that saves you when everything electronic fails.
A sane setup, concretely
For most people the setup that survives realistic failure looks like this. Use platform sync for everyday logins because it’s free and automatic. Put bank, email and crypto exchange passkeys in a password manager with a printed recovery kit, so a single locked platform account can’t take everything down. Add one hardware token as a second factor on your Apple, Google and Microsoft accounts. Those three are the real root of trust. Keep a spare token in a drawer. Generate and print the recovery codes for each of those three accounts once and put the paper somewhere fire-safe. that’s maybe one evening of work, and it turns passkeys into something you can afford to lose a device to.
Passkeys fix phishing, which passwords never did. Still, a login system is only as good as its worst recovery path, and for most people that path is still a decade-old account chain they have never tested. Test it before the phone goes in the lake rather than after.