Passkeys protect the login. Check your recovery route before losing your phone

You can unlock your phone in seconds. If it vanished tomorrow, which device or recovery route would let you back into your important accounts? That is a useful question to answer while the phone is still in your hand, not a reason to avoid a stronger way to sign in.

In its 23 April assessment, the UK's National Cyber Security Centre recommends passkeys where services support them, with two-step verification where they do not. That is the NCSC's security assessment, not a PING test or a promise that every part of an account is invulnerable.

Understand what you are keeping

The NCSC's public guide describes passkeys as a way to authenticate using your device's usual unlock method, such as a fingerprint or PIN. A credential manager creates and stores them and can synchronise them across trusted devices. Check your own manager's behaviour rather than assuming every passkey is available on every device you own.

Make a short account inventory: the service, the credential manager or device holding its passkey, and the official recovery instructions. This is a map of where to look, not a document for passwords, PINs or recovery codes. Keep sensitive recovery material only through the secure storage method appropriate to that service.

Protect the account behind the convenience

The NCSC identifies authentication protecting the synchronisation account as an important control. That means your planning should include the account used by your credential manager, not just the website you are trying to enter. Check its official security and recovery settings while you can still sign in.

Keep a borrowed device out of the setup

Google tells users to create passkeys only on devices they personally own and use. Its warning is specific: someone able to unlock that device can access the Google Account through the passkey, even after sign-out. Do not create one on a shared computer merely to make today's login easier.

For a work or school account, check the administrator's instructions before changing sign-in arrangements. Google notes that Workspace administrators may not permit a passkey-only sign-in. A personal-account tutorial is not permission to change an employer's controls, and this article does not tell you to bypass them.

Check the fallback before you need it

Google's lockout-prevention guide describes recovery information and additional sign-in options, including backup codes for two-step verification. It recommends a recovery email different from the Google sign-in address. Newly changed authentication or recovery factors can take up to seven days to take effect; setting something up is not proof that it is ready immediately.

Before replacing or resetting a phone, follow the provider's instructions to confirm the replacement sign-in route works. Keep the current trusted device available during that check. Do not delete every existing password, key or recovery method as a demonstration that you have moved on. If the result is unclear, stop and use the official support route rather than escalating changes.

For a lost device holding a Google passkey, Google's passkey help says to sign in from a device you can access and remove the lost device's passkey. Its 'Try another way' option returns to earlier sign-in choices. Other services have their own procedures; do not assume these exact controls exist everywhere.

Plan around your actual journey

For someone moving between the UK and an African country, include the practical questions: will you have the trusted device, can you reach the recovery address, and can your recovery number receive the messages your provider requires? Do not assume an office computer or borrowed phone is an equivalent substitute. This checklist establishes no country-specific service availability.

The useful finish is one account with an understood sign-in and recovery route, not a rushed reset of everything. Keep passwords and two-step verification where passkeys are unavailable, as the NCSC advises. For more on the systems that keep people connected, visit PING's Networks desk.