Skip to main content

Lost Passkey Access

When a Passkey No Longer Signs You In

Passkeys cannot be restored - a hardware-bound credential exists only on the device that created it. Getting back in means using another registered device, a password, or the service's recovery process, then registering a fresh passkey. Diagnose which of the four causes applies before assuming the worst.

Which Problem Is It?​

SymptomLikely cause
The device is not detected at allA connection problem, not a passkey one
The site never offers the security key optionThe site is restricting to platform authenticators
You are locked out of the FIDO PINA PIN lockout
The device is gone, or the applet was resetThe passkey is genuinely gone - read on

Work through them in that order. The first two are far more common than the last, and both are fixable without losing anything.

The Site Does Not Offer Your Device​

Not a lost passkey - the site is not asking for it.

Look for "Use another device", "Security key" or "Other options" in the browser prompt. Many implementations default to Touch ID or Windows Hello and hide external keys one click deeper.

Try a Chromium browser. External key support over NFC is most consistent there.

Check you are on the right domain. A passkey only responds to the exact domain it was created for - that is the point. If you followed a link and landed on a lookalike, your device is refusing correctly. Type the address yourself and try again.

The Passkey Is Genuinely Gone​

Device lost, device destroyed, or FIDO applet reset. There is no restoring it: the private key was generated inside the secure element and existed nowhere else.

That is the same property that makes it unstealable, and it means recovery is about getting back into the account, not about recovering the credential.

Get Back In​

In order of preference:

  1. Another registered device. If you registered a second Seedkeeper PRO, use it. Nothing else is needed.
  2. Your password, where the service still has one. Most keep it as a fallback.
  3. Recovery codes, if you saved them when setting up the account.
  4. The service's account recovery, which usually runs through your email - which is why securing your mailbox first matters more than anything else.

Then Clean Up​

Once you are back in, on every affected account:

  • Remove the dead passkey from the security settings. It will otherwise sit there indefinitely, and you will not remember later which entry corresponds to what.
  • Register a fresh passkey on your current device.
  • Register a second one while you are there, if you have a backup device - see Passkey Backup Strategy.

Doing all three in one pass per account is much faster than revisiting each service twice.

The Passkey Exists but Fails​

Rarer, and worth checking before concluding anything is lost.

Confirm it is still on the device. List the stored passkeys from the Seedkeeper PRO App, or from Windows or Chrome - see Managing Passkeys From Your Computer. If the entry is there, the device is fine.

Check the service did not remove it. Some services revoke credentials after a password change, a security event, or a long period of inactivity. Look at the account's list of registered passkeys.

Check you are not confusing two devices. If you registered a card and a ring, either signs you in - but only for the accounts where that specific one was registered.

If You Were Fully Passwordless​

The hardest case: a service where you removed the password entirely, with only one device registered.

Your options narrow to the service's own recovery process, and how well that goes depends on the service. Some are helpful, some are extremely slow, and a few offer nothing at all.

This is exactly why the recommendation is always to register a second device before going fully passwordless - see Are Passkeys Safer?.

One device is a single point of failure

A backup Seedkeeper takes ten minutes to set up and removes the one real risk of hardware security: losing the only device that holds your credentials. Card, ring, or one of each - they pair in any combination.


Add a backup device

FAQ​

Can I recover a lost passkey?

No. A hardware-bound passkey exists only on the device that created it, with no cloud copy. Recovery means getting back into the account another way and registering a fresh passkey.

My passkey stopped working but the device still has it. Why?

Often the service removed it after a password change or security event, or you are on a slightly different domain. Check the account's registered passkeys, and confirm the entry is still listed on the device.

The website will not offer my security key. What now?

Look for "Use another device", "Security key" or "Other options" in the browser prompt - many sites default to the built-in authenticator and hide external keys one level down. A Chromium browser also helps.

Should I remove the dead passkey from my account?

Yes. It cannot be used, but leaving it clutters your security settings and makes it harder to tell which entry belongs to which device later.

What if I removed my password and lost my only device?

You are limited to the service's own account recovery, and the experience varies a great deal. This is the scenario that registering a second device beforehand exists to prevent.

Still stuck?

If none of the above resolved it, open a support ticket and tell us what you tried - the steps you followed and what happened instead. We read every one, and a clear description usually gets you a straight answer rather than a round of questions.

Open a support ticket
Last updated on