Before replacing a device, prove that each important account has a sign-in path that does not depend on the device being retired. Passkeys may sync through a credential manager, remain only on a hardware key, or be tied to a particular device. The safe sequence is verify, add, test, and only then remove.
Inventory the accounts and credential managers
List the important accounts that use passkeys and note where each passkey is stored: Apple Passwords and iCloud Keychain, Google Password Manager, Microsoft Password Manager, a third-party password manager, a hardware security key, or the device itself. Do not copy private keys or recovery codes into the checklist. Record only the account, storage system, device, last successful sign-in, and the location of approved recovery material.
Confirm synchronization and recovery factors
Check that the credential manager is signed in and syncing on another device you control. Confirm the account's recovery email and phone number, and locate backup codes or a spare security key where the service supports them. Google states that adding a passkey does not remove existing authentication or recovery factors. Apple explains that iCloud Keychain can recover synchronized passkeys after device loss through its protected recovery process, but that recovery still depends on Apple Account authentication, a registered phone number, and the device passcode.
Do not infer that every passkey syncs. A passkey stored on a hardware key stays with that key, and an account may use a credential manager different from the one you expect. Check the account's own passkey list.
Add and test the replacement first
Set up the new device with its screen lock, current operating system, and intended credential manager. Create or sync the new passkey, then sign out of a low-risk session and sign back in with it. Test one fallback method without consuming or exposing the only recovery code. Microsoft specifically advises setting up new passkeys first on a new device and deleting obsolete passkeys afterward.
For Google Accounts, review the Passkeys and security keys page and use Try another way to confirm earlier sign-in choices remain available. Google also notes that a newly created passkey can have a waiting period before it is trusted in some situations, so do not erase the old device immediately after creation.
Remove access in a controlled order
After the new passkey and fallback route both work, review active sessions and the account's passkey list. Remove the old device's passkey only when you can identify it confidently. Then sign the old device out, remove the account, disable device-finding activation locks according to the manufacturer's resale instructions, and erase the device through the supported reset process. If the old device is already lost or stolen, use an accessible device to remove its passkey and secure or erase it remotely where supported.
Preserve the evidence
Record the date, accounts tested, new device, credential manager, fallback method verified, old passkey removed, and any waiting period or unresolved account. Keep the old device powered off but available until the highest-value accounts have been tested, unless it is lost, compromised, or must be returned immediately.
The checklist is complete only when the replacement can sign in, the recovery route is current, the old credential is no longer needed, and the retired device no longer retains account access.
Sources: Google passkey guidance, Apple passkey recovery security, and Microsoft passkey troubleshooting.
Sources
- Sign in with a passkey instead of a password — Google Account Help
- About the security of passkeys — Apple Support, Sept. 26, 2024
- Troubleshoot signing in with a passkey — Microsoft Support