The pre-flight checklist for going passwordless without accidentally locking yourself out.
Passkeys are genuinely more secure than passwords, and every major platform now pushes them by default. The catch is the part the setup screens skip: passkeys change how account recovery works, and a lost device or a missing fallback can lock you out of everything at once. That fear is the most common one on security forums, and it is a fair one. Before you switch to passkeys only and turn passwords off, walk through these 13 questions. If you can answer all of them, go passwordless with confidence. If two or three make you pause, you have found the gaps to close first.
In Brief
The short version: passkeys are safe to rely on once your accounts support them, your passkeys are synced or backed up on a second device, and you have a working recovery path that does not depend on the one phone in your pocket. Turning passwords off before those three are true is where people get locked out.
Table of Contents
1. Do the accounts I care about even support passkeys?
Passwordless only works where the account offers it, and coverage is still uneven. Google, Apple, Microsoft, Amazon, PayPal, and GitHub support passkeys well; plenty of banks, utilities, and smaller services do not, or only as a second factor. Check your critical accounts first, especially email and your bank, since those are the ones you cannot afford to lose. The FIDO Alliance, which sets the standard, keeps a searchable directory of supporting sites. If your most important account still needs a password, you are not really going passwordless yet, you are just adding passkeys on top.
2. Are my passkeys synced, or bound to one device?
This is the single most important distinction, and it decides how much risk you are taking. A synced passkey lives in a cloud keychain (iCloud Keychain, Google Password Manager, 1Password, or Bitwarden) and reappears on your other trusted devices automatically. A device-bound passkey lives only on one phone or one hardware key and never leaves it. Synced is far safer for everyday users because losing one device does not erase the credential. Know which kind each of your passkeys is before you delete the password behind it.
3. What actually happens if I lose the device?
Answer this one honestly before anything else. If your passkeys are synced, a lost or broken phone is an inconvenience: sign into the keychain on a new device and they come back. If they are device-bound with no backup, losing that device can lock you out of that account for good. The most-upvoted worry on security forums is exactly this, that one stolen phone takes down every account at once. Synced passkeys plus a second enrolled device is what defuses it.
4. Do passkeys work across my mix of devices?
Cross-ecosystem is where passwordless still gets awkward. Passkeys are a cross-platform standard, but the sync happens inside each vendor’s keychain, so an iCloud-synced passkey does not automatically appear on your Windows laptop. If your life spans an iPhone, an Android tablet, and a Windows PC, a third-party manager like 1Password or Bitwarden that runs everywhere often beats the built-in keychains. Map your actual devices before you commit, not the ideal all-one-brand setup.
5. Have I enrolled a second device or a backup key?
Never rely on a single point of failure. Add your passkey to at least two places: two devices, or one device plus a hardware security key kept somewhere safe. A cheap FIDO2 key in a drawer is the closest thing to an unbreakable backup, since it does not depend on any cloud. This one habit turns a lost phone from a crisis into a shrug.
6. What is my fallback when a passkey login fails?
Passkeys fail sometimes: a Bluetooth handshake drops, a keychain does not sync, a site’s implementation is buggy. Before you turn the password off, know the backup route for each account, whether that is one-time recovery codes, a backup email, or a second factor. Save recovery codes somewhere that is not on the device holding the passkey. A fallback you cannot reach is not a fallback.
7. Which vault holds my passkeys, and do I trust it?
Going passwordless concentrates a lot of trust in one keychain. If it is Apple or Google, that is tied to an account you must protect fiercely, since whoever controls it controls your logins. If it is a dedicated manager like 1Password or Bitwarden, that account becomes the crown jewel instead. Either way, put the strongest protection you have on that one account, and treat its own recovery as the foundation everything else sits on.
8. Can I move my passkeys if I switch managers later?
For a long time the honest answer was no, and you could not export passkeys between managers. That is changing: the FIDO Alliance’s Credential Exchange Protocol is built to move passkeys between vaults, but as of 2026 parts of it, including recovery and revocation details, are still being finalized and support is rolling out. Do not assume painless portability yet. If lock-in to one ecosystem bothers you, factor that in now rather than after you have hundreds of passkeys in one place.
9. Will turning off passwords break a recovery method I still need?
Removing the password sometimes removes a fallback you were quietly relying on. Check whether the account still offers recovery codes or a secondary method once the password is gone, and confirm that method works before you flip the switch. On some services the password was the recovery path, so deleting it without setting up another leaves you with a single door and no spare key.
10. How will this work on shared or family devices?
Passkeys are tied to a person’s keychain, which gets complicated on a shared family tablet or a household computer. Decide whether each family member has their own profile and passkeys, or whether you will use cross-device sign-in from a personal phone instead. For kids’ accounts and shared streaming logins, think through who holds the passkey and what happens when that person is not home.
11. Does my employer allow or require passkeys?
Work accounts follow different rules. Some companies mandate passkeys or hardware keys; others restrict which authenticators are allowed, or manage them through the company’s identity system. Before you rework your logins, check your IT policy, because a personal keychain may not be permitted for work accounts, and a work-managed passkey may vanish when you leave the job. Keep personal and work credentials clearly separated.
12. Can I still sign in on a borrowed or public computer?
Yes, but know how first. Cross-device sign-in lets you use your phone to approve a login on a computer that does not have your passkey, usually by scanning a QR code with Bluetooth nearby to confirm you are physically present. It works well once you have done it once, but it is unfamiliar under pressure. Practice it before you are stuck at a hotel business center trying to reach your email.
13. Is account recovery set up before I delete the password?
This is the last box to tick, and the one people skip. Make sure recovery email, recovery phone, recovery codes, and any trusted contacts are current on your key accounts before you go passwordless. One cautionary story that circulates online involves an attacker who stripped every recovery option off a hacked Google account, leaving the owner with no way back in. Strong recovery is what stands between a lost device and a lost account, so set it up first and never as an afterthought.
How We Chose These
These questions come from the real friction points people hit when going passwordless, not from the marketing pitch. We prioritized the ones with the highest cost of getting them wrong, which are device loss, recovery, and cross-platform gaps, and grouped the rest around the practical realities of shared devices, work policies, and portability. The goal is a checklist you can actually answer in an afternoon before you commit.
The Bottom Line
Passkeys are worth adopting, and for most people they are safer than any password ever was. The mistake is not switching to passkeys, it is turning passwords off before the safety net is in place. If you take nothing else from this, do these three: use synced passkeys or enroll a second device, keep a hardware key or recovery codes as backup, and confirm account recovery works before you delete a single password. Get those right and passwordless is a genuine upgrade. For related reading, see YouGottaRead’s guide to protecting your accounts from takeover, and browse the Tech section for more security how-tos.
Frequently Asked Questions
Is it safe to switch to passkeys only and turn off passwords?
Yes, once three things are true: your important accounts support passkeys, your passkeys are synced or saved on a second device, and account recovery works without the password. If any of those is missing, keep the password as a fallback until you close the gap.
What happens to my passkeys if I lose my phone?
If they are synced to a cloud keychain, you sign into that keychain on a new device and they return. If they are device-bound with no backup, losing the device can permanently lock you out of that account. This is why a second device or hardware key matters before going passwordless.
Do passkeys work across Apple, Google, and Windows?
Passkeys are a cross-platform standard, but syncing happens inside each vendor’s keychain, so a passkey saved in iCloud does not automatically appear on Windows. If you mix ecosystems, a third-party manager like 1Password or Bitwarden that runs everywhere is usually smoother than the built-in keychains.
Can I move passkeys between password managers?
Not easily yet. The FIDO Alliance’s Credential Exchange Protocol is designed to move passkeys between managers, but as of 2026 it is still being finalized and rolled out. For now, assume switching managers means re-enrolling passkeys rather than exporting them.
Should I keep any passwords as a backup?
For accounts where recovery is thin or the service’s passkey support is new, keeping a strong password plus passkey is reasonable. Go fully passwordless first on mature accounts like Google, Apple, and Microsoft, where recovery is solid, and hold off where the fallback is unclear.
