Losing your phone does not lock you out of your Google Account, because adding a passkey doesn't change or remove your existing sign-in or recovery methods. The real risk runs the other way: anyone who can unlock that phone can get into your account, so remove the lost phone's passkey from another device you control as soon as you can.
Picture leaving your phone in a taxi. Your password still works on your laptop, so you are not stranded. But if the driver, or whoever finds it, knows or guesses your PIN, the passkey on that phone opens your Google Account with no password and no second step. Google's help page warns that this applies even if you've signed out of the account on that device. That is why the cleanup matters more than the recovery.
Is a Google passkey stored only on the phone that made it?
Google describes the passkey as tied to your device: the biometric part never leaves it. Per Google's passkey help page, your fingerprint or face data stays on the device and is never shared with Google. You unlock a passkey with a fingerprint, a face scan, or the phone's screen lock, such as a PIN.
That is also why Google says to create a passkey separately on each device you use. Setup lives at myaccount.google.com/signinoptions/passkeys: choose Create a passkey, unlock the device, and repeat on the next one.
One complication: if you remove a passkey but Google still asks for it, Google says it may be saved in a third-party credential manager, and you'll need to delete it there using that manager's instructions.
How do I remove the passkey for a lost phone?
Use any device where you are still signed in. There are two paths, because Google says Android phones signed in to your account may register passkeys automatically, and those are handled by signing the device out rather than removing a passkey.
To tell which path is yours, start with the passkeys list: open your Google Account, go to Security & sign-in, and under How you sign in to Google choose Passkeys and security keys. If the lost phone's passkey appears there, use the first set of steps below. If it doesn't, use the sign-out steps.
If the lost phone's passkey is in your passkeys list
- Open your Google Account and go to Security & sign-in.
- Under How you sign in to Google, choose Passkeys and security keys.
- Select the passkey for the lost device and tap Remove.
If it isn't in the list (Android created it automatically)
- Open your Google Account and go to Security & sign-in.
- Under Your devices, choose Manage all devices.
- Select the lost device and choose Sign out.
Be clear about what this does. Signing the phone out does not stop its passkey instantly: per Google's help page, after an Android device is signed out, the passkey can still be used to sign back in for up to 6 hours. After 6 hours, getting back in requires another sign-in method. So the sign-out cuts off the lost phone's passkey, but only once that window has passed.
Google notes that several sessions can share the same device name, so sign out of every one with that name to be sure. You can review everything with access to your account at google.com/devices.
Do passkeys bypass 2-Step Verification?
Yes. If your account uses 2-Step Verification or Advanced Protection, a passkey skips the second step. Google's reasoning is that the passkey already proves you own the device.
This is the trade-off people miss. Google says passkeys can't be shared, copied or written down, which makes them harder to phish than a password. A fake login page has nothing to steal. (For how convincing a fake download can look, see how Binance's heist started with a fake Homebrew installer.) But physical access to an unlocked phone becomes a full key to your account. A weak screen lock now protects your Google Account too.
Google's advice follows from that: create passkeys only on devices you personally own, never on shared ones.
What happens to my passkey after I sign out?
It depends on the platform, according to Google's help page:
| Device | After you sign out of your Google Account |
|---|---|
| Android | You can sign back in with the passkey for up to 6 hours. After that you need another method. When you sign in again, Android generates a new passkey and the old one expires. |
| Non-Android | You can sign back in with the passkey at any time. |
So signing out on an iPhone or a computer does not retire the passkey. Removing it from your account does.
How do I get my password back instead of the passkey?
Creating a passkey opts you in to passkey-first sign-in. To go back to a password prompt:
- Open your Google Account and go to Security & sign-in.
- Under How you sign in to Google, turn off Skip password when possible.
With that off, Google asks for your password. If you use 2-Step Verification, Google says any of your passkeys can act as the second step, which keeps some of the phishing protection without letting a passkey stand in for everything.
On a work or school account, your admin decides what's allowed. Google says Workspace accounts may not permit passkey-only sign-in, though passkeys can still serve as a second factor, a recovery option, or re-verification for sensitive actions. The Skip password when possible settings page shows what your admin permits.
Why doesn't my new passkey show up at sign-in?
Google lists three things to check:
- Your screen lock is on.
- Skip password when possible is on.
- It has been less than 7 days since you created the passkey. Google says a new passkey may take up to 7 days to work at sign-in, and having an existing trusted passkey or security key may speed that up.
There's also a habit effect. Choosing Try another way skips the passkey, and if you do it often, Google offers passkeys less often. Signing in with passkeys repeatedly reverses that.
If Google spots a passkey it considers suspicious, it disables it and notifies you. You then have 30 days to confirm you added it, or it gets deleted.
How do I sign in on a computer using my phone's passkey?
On the computer's sign-in page, choose Try another way, then Use your passkey. Scan the QR code with your phone and verify with your fingerprint, face or PIN. Bluetooth needs to be on. Google says the next time you use the same computer and phone together, you get a notification on the phone automatically.
For the requirements, Google lists Windows 10, macOS Ventura or ChromeOS 109 or newer on the computer, Android 9 or iOS 16 or newer on the phone, and Chrome 109, Safari 16, Edge 109 or Firefox 122 or newer as the browser. iPhone, iPad and Mac users need iCloud Keychain turned on. Passkeys may not work in Incognito mode on some systems.
What to change now
Set a screen lock on your phone that someone can't guess, because it now guards your Google Account as well. Create passkeys only on devices that are yours alone. Keep your password and recovery options current, since they are what gets you back in if the phone is gone. And bookmark google.com/devices: if a phone goes missing, removing its passkey or signing it out from there is the first thing to do.
