Changing phones? Check your passkeys before erasing the old one

Before you trade in an old phone, check that you can sign in to your important accounts from the replacement. Moving photos and messages is only part of the job. The sign-in methods and recovery options deserve their own check.

Passkeys can make signing in easier, but the word does not describe one identical setup across every service and device. Where a passkey is stored and how it becomes available elsewhere affect what you need to do during a phone change.

This guide explains the distinction and offers a practical checking sequence. Follow the instructions for your own provider, and ask your workplace or education administrator about managed accounts before changing their security settings.

Know what is doing the signing in

The FIDO Alliance's passkey guide describes passkeys as credentials based on cryptographic keys. They can be synced through a provider or remain bound to a device, including a hardware security key. A fingerprint, face scan or device PIN can authorise their use.

The important distinction for a phone change is whether the credential is available through your chosen provider on the new device or is tied to the old one. Do not assume that seeing a familiar app icon proves its sign-in method is ready.

Start by listing the accounts you cannot afford to lose access to. Your main email, the account used for your phone's services and any password manager are sensible places to begin. This is a planning list, not a place to write passwords, recovery codes or other secrets.

Check the provider, not just the website

A website account and the service storing its passkey are different parts of the arrangement. Write down which provider manages the passkey and whether you are using the same provider on the new phone.

FIDO explains that someone moving between mobile platforms may use a compatible cross-platform provider, a hardware key or the old device to sign in and create a credential in the new provider. The available route depends on the setup. There is no need to assume every credential will move automatically.

Ask a concrete question for each important account: can I complete a fresh sign-in on the new device using the method I intend to keep? A successful transfer animation or an app that remains logged in does not answer that particular question.

Test while the old phone is still available

Use a staged checklist. First, set up the new phone through the provider's official process. Next, test the important accounts. Then review recovery options. Only after those checks should you decide the old device is ready for the appropriate sign-out and erasure process.

Keep an existing trusted session available while testing another sign-in. Avoid turning a test into an unnecessary lockout by signing out everywhere at once. If you are unsure how to test safely, use the provider's help material or support channel before changing anything.

Record a simple result beside each account: tested successfully, needs attention or managed by an administrator. That is enough to track progress. You do not need screenshots of security settings containing private information in a shared checklist.

Google is one example, not a universal rule

Google's passkey instructions say adding a passkey does not remove the account's existing authentication or recovery factors. They also explain that the biometric information used to unlock the device stays on the device.

If you use Google, review the actual sign-in and recovery settings for your account rather than assuming passkey creation finished every security task. Other services can have different controls, so use their own documentation for the equivalent check.

A useful question is what would happen if the new phone were unavailable tomorrow. You are looking for an approved alternative route that you understand and can access, not a shortcut that weakens the account's protection. Do not give verification codes to another person offering to perform the setup for you.

Review recovery before you need it

Google's recovery-options guide recommends adding recovery information and notes that availability varies by account, region and device. Changes to some recovery details may take time to become trusted.

For your own accounts, check that recovery contact details are current and that you can access the relevant phone number or email address. If an option relies entirely on a device you are about to erase, investigate the provider's recommended alternative first.

Keep any provider-issued recovery material in a private, appropriate location. The purpose of this exercise is to reduce dependence on one device without spreading sensitive information across messages and documents. A list saying 'recovery checked' is safer to share than the recovery information itself.

If you are already locked out

Use the service's official recovery process. Google's account-recovery guidance, for example, warns that it does not work with services claiming to provide account or password support. It tells users not to hand over passwords or verification codes.

A third party promising instant recovery is not evidence that it can legitimately restore access. Keep the conversation within the provider's documented process, and contact an administrator for a work or school account where that is required.

For a planned phone change, the best outcome is less dramatic: a short list of successful sign-in tests, current recovery options and no important account depending solely on the device you are handing over. Complete that check while you still have time and access. It is much easier than trying to reconstruct the setup after the old phone has gone.