Create a Google Passkey Without Locking Yourself Out

Check recovery access first. Before creating anything, confirm that your recovery phone number and email still work, another trusted device can reach the account, and every device storing the credential has a screen lock.

A passkey is a digital credential tied to a user account and a website or application. It replaces a reusable secret with a public key held by the service and a private key protected by your device or credential manager. The WebAuthn specification↗ defines that public-key model and requires user verification where the service requests it.

Do this inventory:

• Open your Google Account and select Security.
• Check Recovery phone and Recovery email.
• Confirm that the listed addresses and numbers remain under your control.
• Open Your devices and sign out hardware you no longer own.
• Verify that your phone, tablet, or computer requires a PIN, fingerprint, face scan, or password after waking.
• Keep at least one independent sign-in method while you test the passkey.

A fingerprint or face scan does not travel to Google as biometric data. The local operating system uses it to authorize access to the private key, much as it authorizes access to other protected credentials on the device.

Do not rush deletion. Google accounts still support passwords and recovery options, and retaining them during setup is sensible protection rather than a failure to commit to passkeys.

Create it from your account. On a private device with a working screen lock, visit the passkey management page, choose Create a passkey, and approve the request using the device PIN, fingerprint, or face scan.

1. Open g.co/passkeys and sign in to the intended Google account.
2. Select Create a passkey.
3. Confirm the device or credential manager shown in the prompt.
4. Follow the prompts and complete the requested screen lock check.
5. Return to the passkey list and verify that the new entry appears with a recognizable device or provider name.
6. Leave the page open until you have tested a separate sign-in.

Google's passkey developer documentation↗ explains that passkeys use public-key cryptography and can be synchronized by supported platform credential managers. That synchronization detail matters: a credential created in Google Password Manager may become available on compatible signed-in Android or Chrome devices, while one stored in a hardware security key remains on that key.

Names can be vague. An entry such as “Android device” or a browser-generated label may not identify a specific handset, so record the creation date and remove only entries you can positively match.

If Create a passkey never appears, first update the browser and operating system, then check that screen lock is enabled and that the browser is not in a temporary guest profile. Managed work or school accounts may also have administrator restrictions.

Choose the passkey prompt. At Google sign-in, enter the account identifier if requested, select the passkey option, and approve it with the screen lock on the device holding or synchronizing the credential.

The exact wording varies among Chrome, Safari, Android, Windows, and macOS because the operating system handles the credential picker. Look for options such as Use your passkey, Try another way, or Use another device rather than searching for a password field.

For a nearby phone:

1. Select Use another device on the computer.
2. Choose the phone or QR-code option.
3. Scan the displayed code with the phone's camera.
4. Keep Bluetooth enabled on both devices when proximity verification is requested.
5. Approve the sign-in with the phone's PIN, fingerprint, or face scan.

This cross-device method does not copy the private key onto the borrowed computer. The phone proves possession and user verification, while the browser completes the signing exchange with the account service.

Stop if the domain is wrong. Passkeys are resistant to phishing because the credential is scoped to the legitimate site, but users can still be tricked into approving unrelated recovery actions or disclosing a password elsewhere. The Google Account security area↗ is the right place to review recent activity after a suspicious prompt.

Its provider stores it. The private credential may live in Google Password Manager, Apple Passwords and iCloud Keychain, Windows Hello, another password manager, or a physical security key, depending on the option selected during creation.

“Securely stored in your Google Account” can be misleading shorthand because the storage and synchronization path depends on the platform and credential provider that generated the passkey. Google Password Manager can synchronize passkeys across supported devices, but a locally bound Windows Hello credential or hardware key follows different availability rules.

Check the actual holder:

• On Android or Chrome, inspect Google Password Manager and its passkey entries.
• On iPhone, iPad, or Mac, inspect the Passwords app and confirm iCloud Passwords synchronization.
• On Windows, check whether the prompt identifies Windows Hello or another phone or credential provider.
• For a hardware security key, keep the key itself and its PIN available.

Storage decides recovery. If a synchronized manager holds the credential, signing into that manager on a replacement device may restore access after its own verification steps; if the credential is device-bound, losing that device loses that copy.

Keep an independent route. A second signed-in device, another passkey stored through a different provider, a security key, or current account recovery details should work without the missing phone.

Test that route before treating the setup as finished, because seeing two passkey entries is not enough when both synchronize through the same account and depend on the same unavailable recovery channel.

1. Open a private browsing window on another device.
2. Start a Google sign-in without using the newly configured phone.
3. Select Try another way if the first passkey prompt targets that phone.
4. Complete sign-in with the backup device, another passkey, a security key, or the retained password and verification method.
5. Confirm that the account opens normally, then sign out of the private window.
6. Store recovery codes offline if the account offers them for its two-step verification configuration.

One backup is brittle. A phone and tablet using the same synchronized credential manager improve device availability, but a separate security key or independently recoverable method protects against a problem with that manager account.

If the phone is already gone, use Google's account recovery entry point↗ from a familiar device and network. Do not repeatedly guess answers or reset settings from unfamiliar locations, since inconsistent recovery signals can slow verification.

Remove it after replacement. Delete an old credential only after a new one appears in account security, succeeds in a fresh sign-in, and an independent recovery method has also been verified.

Open Google Account, select Security, find Passkeys and security keys, choose the entry belonging to the sold, lost, shared, or reset device, and select Remove. The old device may also retain a local credential record, so erase or remove it from its password manager when the hardware remains accessible.

Removal has a narrow effect. It revokes that registered credential from the Google account, but it does not necessarily sign out existing browser sessions or erase every local copy displayed by a credential manager.

For a lost device, also review Your devices, sign out its account session, and use the platform's remote-lock or erase controls where available. Account sessions and passkeys are separate pieces of protection; cleaning up one does not automatically settle the other.