Passkeys Explained: The Order to Switch From Passwords in 2026 (Without Locking Yourself Out)

Specops Software’s 2026 Breached Password Report, published in January 2026, analyzed more than 6 billion malware-stolen passwords captured over the course of 2025 — roughly six times the 1.09 billion passwords its previous edition had analyzed the year before. The most commonly compromised passwords were still things like “123456” and “password.” None of that is new information, exactly, but the scale of it is what’s changed: infostealer malware is now harvesting credentials at a pace passwords alone can’t really defend against.

That’s the backdrop for why Google, Apple, and Microsoft have all been pushing harder on passkeys through 2026. FIDO Alliance’s own May 2026 tally put 5 billion passkeys in use worldwide, with 75% of people having enabled a passkey on at least one account and 49% using them regularly when the option is there. Microsoft has been rolling passkeys out as the default sign-in method for Entra accounts, with native SMS/voice authentication scheduled to be retired for those accounts in early 2027. The direction of travel is obvious. What’s a lot less obvious is the order in which an ordinary person should actually do this — and that’s the part almost every “what are passkeys” explainer skips.

Get the order wrong, and the failure mode isn’t abstract: you end up locked out of an account with no working password, no working passkey, and a recovery flow that assumes you still have the phone you don’t have anymore. This is a practical migration guide, not another definition of what a passkey is.

Why the order matters more than the technology

A passkey is a cryptographic key pair — the private half lives on your device (or a hardware key), the public half sits with the service you’re logging into, and no shared secret ever gets typed, stored, or phished the way a password does. That’s genuinely a better security model. But the order you convert accounts in matters because of one simple fact: your email account is the recovery mechanism for almost everything else you own. Forget your banking password, and the bank sends a reset link to your email. Lose access to a shopping account, and the “forgot password” flow routes through email too. If your email account itself becomes the weak link — or worse, if you get locked out of it while mid-migration — every other account’s safety net disappears at the same time.

That’s the logic behind prioritizing accounts by how much other access depends on them, not by how important the account feels day to day.

The migration order that actually protects you

Email first. This is the recovery hub for nearly every other account you have. Set up a passkey here, keep the password active as a fallback for now, and make sure at least one backup method is enrolled (a second device, or a hardware security key) before you rely on it exclusively.
Password manager. If you use one (1Password, Bitwarden, Google Password Manager, iCloud Keychain), it’s often the vault holding recovery codes and remaining passwords for everything else — protect it early, right after email.
Banking and financial accounts. High-value, high-consequence targets, and most major banks have added passkey support over the past year. Convert these once your recovery hub (email) is solid.
Work and SSO accounts. If your employer uses Microsoft Entra, Okta, or Google Workspace single sign-on, one passkey here can cascade into every connected work tool — worth doing carefully, and worth checking with IT if a backup method is centrally managed.
Social and shopping accounts last. Lower individual stakes, and usually the accounts with the most complete passkey support already, so they’re the easiest to convert once you’ve got the process down on higher-stakes accounts.

The point isn’t that social media doesn’t matter — it’s that if something goes wrong on your first attempt, you want it to go wrong on an Instagram login, not on the email account everything else depends on.

Before you switch anything, do this

Enroll a genuine backup method before you rely on a passkey as your only login. That means either a second device signed into the same ecosystem (a tablet alongside your phone) or a separate hardware security key registered to the account.
Don’t delete the password immediately. Most services let a passkey and a password coexist for a transition period. Keep the password (ideally in a password manager, not memorized) until you’ve confirmed the passkey actually works across every device you use for that account.
Check the account’s specific recovery options before you need them, not after. Look for whether the service supports a recovery contact, backup codes, or a secondary email/phone — and actually write down or securely store any one-time recovery codes it gives you at setup, since those are usually shown only once.
Confirm the service actually supports passkeys fully, rather than just accepting one as an extra factor. Some sites still fall back silently to a password-plus-2FA flow behind the scenes, which is fine, but you should know that’s what’s happening rather than assume you’ve gone fully passwordless.

The failure modes that actually lock people out

Losing the one phone that held your passkeys, with no second device or backup key enrolled. This is the single most common lockout scenario, and it’s entirely preventable — the fix is simply having a second synced device or a hardware key registered before you need it, not after.
A service reverting to password + 2FA without telling you clearly. Not every “passkey-supported” service has fully retired its password flow yet, and a reset or an app update can silently drop you back to a login method you thought you’d retired.
Assuming passkeys sync the same way across Google, Apple, and Microsoft. They don’t, and this is the detail most explainers get vague about — see below.
Switching your primary email account to passkey-only before setting up a backup method on it specifically. Because email is the recovery hub for everything else, a lockout here is the worst version of this problem to have.

How passkey sync actually differs by ecosystem

This is the part worth getting right, because the three big platforms don’t behave identically:

Apple (iCloud Keychain): Passkeys sync automatically across your iPhone, iPad, and Mac as long as iCloud Keychain is turned on for each device. If you lose every Apple device at once, Apple’s account recovery relies on either a designated recovery contact or iCloud Keychain’s escrow mechanism, which requires authenticating on a new device and responding to a verification sent to a trusted phone number — Apple designs this so the keychain data itself can’t be read by Apple in the process.
Google (Google Password Manager): Passkeys saved to your Google Account sync across devices signed into that same account, usable anywhere Chrome runs. If you lose the Android phone that held them, Google’s official guidance is to sign in to your Google Account from another device and remove the lost device’s access — and note that a passkey on an Android device can still be used to sign in for up to six hours after you’ve signed out of that device, which is a detail worth knowing if a phone goes missing rather than being reset immediately.
Microsoft (Windows Hello vs. Microsoft Password Manager): This is the ecosystem with the sharpest internal split. For work/school (Entra) accounts, Microsoft supports both device-bound and synced passkeys, and which one you get is a policy choice set by the organization’s IT admin rather than a fixed default — Microsoft’s own guidance recommends device-bound options (like a FIDO2 security key or Microsoft Authenticator passkey) for users with elevated privileges or in tightly regulated environments, and synced passkeys as the more convenient option for the general workforce. Passkeys saved through Microsoft Password Manager for a personal Microsoft account, by contrast, do sync across devices signed in with that same account. If you’re mixing a personal Microsoft account and a work Entra account, don’t assume “passkey” means the same sync behavior on both — check with your IT team if you’re not sure which policy applies.

The practical upshot: before you lean on any single passkey as your only way into an account, know whether that specific platform treats it as something that quietly follows you to a new device, or something that dies with the device it was created on.

A backup device that isn’t your phone

Because so many lockout scenarios trace back to “I only had one device,” a physical hardware security key is worth considering as a deliberate backup — not a replacement for your phone’s built-in passkey support, but a second, independent factor that doesn’t depend on your phone’s battery, network connection, or survival. Most major services that support passkeys also support registering a hardware FIDO2 key alongside your phone.

FIDO2 hardware security key

A physical backup key you can register alongside your phone's passkeys — useful specifically for your email and password manager accounts, where a lockout has the widest knock-on effect.

Check Price on Amazon

The bottom line

Passkeys are a genuine security upgrade over passwords, and the platforms are making that upgrade harder to avoid by the month. But the actual risk most people run into isn’t the technology — it’s converting accounts in the wrong order, or converting a single account without a real backup method behind it. Do email first, since it’s the recovery hub for everything else. Do your password manager next. Keep the password around as a fallback until you’ve proven the passkey works everywhere you need it to. And before you trust a passkey as your only way in anywhere, know whether that platform actually syncs it to a new device or leaves it stranded on the one you lost.

Editorial Note

This article is an independent summary and analysis based on reporting and documentation from Specops Software/Outpost24, the FIDO Alliance, Microsoft, Google, and Apple. All original reporting and product documentation credit belongs to those sources.