Short answer: passkeys are generally more resistant to phishing and password reuse than a memorized password. On an iPhone, Face ID, Touch ID, or the device passcode can authorize a passkey stored in a credential manager. If you lose the phone, recovery depends on where that passkey is stored and whether you can still access the manager or the website’s recovery options. Set those up before you need them.
Why passkeys are getting more attention
Passkeys are moving from an unfamiliar sign-in option into routine use. In its October 2026 Passkey Index, the FIDO Alliance reported that 36% of successful sign-ins used a passkey across participating consumer services, compared with 26% in its 2025 index. The comparison is directional: the 2026 index included 15 participating services and the 2025 index included nine. It is adoption data, not a measure of Google search volume.
That shift creates practical questions people search for: What is a passkey? Is a passkey safer than a password? And what happens to my passkeys if I lose my iPhone? This guide answers those questions using platform documentation and explains the recovery tradeoffs before you switch.
What is a passkey, in plain language?
A passkey is a cryptographic sign-in credential created for a specific website or app. It uses a pair of keys: the service keeps a public key, while the private key is held by your device or credential manager. During sign-in, your device proves it has the private key; the private key itself is not sent to the website as a password would be.
Apple’s passkey security documentation explains that passkeys use public-key cryptography and are designed to resist phishing. A fake website should not be able to use a passkey made for the real site. Face ID or Touch ID is an approval step on your device—it is not the passkey, and your face or fingerprint is not sent to the site as the credential.
Passkeys reduce risks such as password reuse and credential theft through fake login pages. They do not make an account invulnerable: someone may still target your device, credential-manager account, email account, or the website’s recovery process.
Passkey vs. password: what changes?
- Password: you type a shared secret into a site. Reused or phished passwords can be tried elsewhere.
- Passkey: your device uses a site-specific private key to approve a sign-in. The site stores the corresponding public key, so there is no reusable password to type or send.
- Face ID or Touch ID: this can unlock or authorize use of the passkey locally. It does not replace the account’s credential or recovery plan.
Some services still offer passwords, email links, text codes, or support-assisted recovery as a fallback. Those fallback methods can become the weaker route into an account, so secure them too. Keep a unique password and strong multi-factor protection wherever a service still requires them.
Where are passkeys stored on an iPhone?
It depends on which credential manager you choose. With Apple’s iCloud Keychain, passkeys sync across approved Apple devices using end-to-end encryption. Apple says its keychain recovery process is designed to restore access even if all associated devices are lost, using account verification and a protected recovery process. A designated Apple Account recovery contact is another option to prepare in advance.
You can also use a compatible third-party manager. For example, Google’s documentation says Google Password Manager passkeys can be used across supported devices signed in to the same Google Account. On iPhone or iPad, Google says saving them requires iOS or iPadOS 17 or later and Chrome configured as the device’s Autofill provider. Check which manager actually saved the passkey and make sure you can sign in to that manager independently of the lost phone.
Some passkeys are tied to a specific device or security key rather than synced through a manager. That can be useful for some security needs, but losing the only device or key may leave you dependent on a second enrolled credential or the website’s recovery procedure.
What happens to passkeys if you lose your iPhone?
There is no single answer for every passkey. If it was saved in a synced credential manager, you may be able to recover it on a replacement device after recovering access to that manager. Apple documents iCloud Keychain recovery through its escrow process or a recovery contact. Google documents syncing Google Password Manager passkeys to supported devices signed in to the same Google Account. The exact steps and requirements can change, so check the current instructions for your manager.
If the passkey was stored only on the missing iPhone—or on a security key you no longer have—you may need another passkey already registered with the service, a backup sign-in method, or the service’s account-recovery process. A website generally cannot recreate a private key that existed only on your lost device. This is why it is worth testing recovery for your most important accounts while you still have access.
Set up passkeys without losing account access
- Check where each passkey is saved. Know whether you use Apple Passwords/iCloud Keychain, Google Password Manager, another password manager, or a device-bound key. Don’t assume every passkey is stored in the same place.
- Keep a second route into important accounts. Add another trusted device, another passkey, a security key, or the service’s recovery method where supported. For your main email and Apple or Google account, verify recovery details now.
- Test before you depend on it. Sign in to the account from a second device or browser using its supported recovery flow. Keep the current sign-in method until you have confirmed the passkey works and the backup route is usable.
- Protect the manager account and phone. Use a strong device passcode, keep the software current, and turn on available theft safeguards. Apple’s Stolen Device Protection adds biometric requirements and security delays for certain actions when enabled; it must be set up before a device is lost.
If your iPhone is stolen
Use a different trusted device to open Find My or Apple’s stolen-device instructions and mark the iPhone as lost as soon as possible. Apple advises not removing a stolen device from Find My, because that can remove Activation Lock. Contact your mobile carrier to protect the phone number, and secure your Apple Account and primary email from a safe device if you think they may be at risk.
Be cautious of messages or calls claiming your iPhone has been found and asking for your passcode, verification code, or account password. Apple says it will not contact you to say a stolen iPhone has been found. Stolen Device Protection helps with some sensitive actions only if it was enabled beforehand; it does not replace Lost Mode or account recovery.
Quick answers about passkeys
Are passkeys safer than passwords?
For phishing and password reuse, passkeys offer important advantages because the sign-in is tied to the genuine site and does not require typing a reusable secret. Device security and account recovery still matter.
Can I use an iPhone passkey on another device?
Often, yes. A passkey stored in a synced manager may be available on other supported devices after you sign in to that manager. Cross-device sign-in may also be offered by the website or credential manager. Check the specific service’s supported options.
Should I delete my password after creating a passkey?
Not until you have confirmed the passkey and recovery path work. Some services keep the password as a fallback; review the account’s security settings and decide based on the service’s documented recovery choices.
Do passkeys protect private files on my phone?
No. Passkeys protect sign-in to accounts; they do not encrypt every document stored on an iPhone. For that separate question, read our guide to securely storing sensitive files on iPhone.