Signing in with a fingerprint feels simpler than remembering another password. The more interesting question arrives later: what happens when you replace your phone, move from Android to iPhone, or decide to leave your password manager?
Passkeys are becoming easier to move, but “passwordless” does not mean there is nothing to manage. Understanding where a passkey lives is the difference between a smooth upgrade and an unexpected account-recovery exercise.
Your fingerprint is not the key sent to the website
A passkey uses a cryptographic key pair rather than a password you type. As the FIDO Alliance explains, you approve its use through a device’s unlock mechanism, such as a PIN or biometrics. Biometric processing stays on the device; the remote service does not receive your fingerprint.
FIDO credentials are tied to the relevant service domain. This provides phishing resistance: a lookalike website cannot simply collect a typed passkey the way it might steal a password. That does not make every surrounding account process immune to fraud, so recovery methods still deserve attention.
Three things that are easy to confuse
Syncing makes a passkey available through a provider on supported devices. Cross-device sign-in lets another device help approve a login. Migration moves supported credentials between providers. These solve different problems.
Google’s current support documentation describes Google Password Manager synchronising encrypted passkeys across supported environments, including Chrome on desktop systems. Availability depends on the operating system and configured provider. Using the same browser name everywhere does not tell you where every credential was saved.
Some passkeys are device-bound, including those kept on hardware security keys. FIDO distinguishes them from synced passkeys: they stay on their original device. Buying a new phone therefore raises a different question depending on which kind you use.
Portability has improved in 2026
In a 23 July 2026 update, Bitwarden described support for transferring credentials through the Credential Exchange Protocol on compatible Android and iOS apps. Its current help page lists mobile passkey import and export on iOS 26 or later and Android 14 or later, with both applications required to support the protocol.
That is meaningful progress, but compatibility is the important word. A standard’s existence does not establish that your exact source app, destination app, device and credential are supported. Read both providers’ current instructions before making the switch.
A password export may leave passkeys behind
For example, 1Password’s current export guidance says passkey export is available in its iOS and Android apps. Its desktop export instructions direct users to create replacement passkeys on the relevant websites and save them elsewhere. A familiar export button is therefore not proof that every sign-in method will move.
This is also why a spreadsheet of passwords is not a complete picture of account access. An account may involve a passkey, an email address used for recovery and additional recovery options. Treat the move as a check of how you regain access, rather than simply a file-copying task.
Before retiring the old device, prove the new route works
Choose an ordinary account to test first. Identify the provider holding its passkey, follow that provider’s supported transfer or setup process, and complete a fresh sign-in from the destination. An account already open in a browser may still be using an existing session, so seeing its home screen is not the same as testing the new credential.
Then check the accounts you would least want to lose: the email service used for recovery, your password manager and other important services. Review their recovery instructions and keep supported recovery material secure. For an employer-managed account, follow the organisation’s process.
Keep the old setup available until you have verified the replacement. If direct transfer is unsupported, use the service’s documented process to add another passkey or arrange recovery. Avoid removing the working credential first and hoping that the next step will succeed.
The real upgrade is control
Passkeys can remove an everyday frustration while making phishing-resistant sign-in more accessible. Portability makes that promise stronger by giving people more freedom to change tools. The useful habit is to know where your credentials live and test the next route before closing the previous one.
For more ways to check technology announcements against their evidence, read our guide to evaluating technology news.
Sources checked 26 October 2026. Product support can change; consult the linked provider instructions for your devices. This article explains the concepts and does not report an independent migration test.
Illustrative photograph: Henry Marsh / Pexels (licence); not a passkey setup demonstration.
