A replacement phone can expose a question that was easy to ignore while the old one worked: where is the passkey you use to sign in? For a crypto account, the useful check comes before you erase or trade in the device. Find out whether your credential synchronises or stays on that particular piece of hardware.
| What you need to know |
|---|
| Passkeys may be synced or bound to one device. |
| The implementation determines whether a credential moves with you. |
| Authenticator passkeys for Entra ID cannot be synced. |
| Test replacement access before erasing the old device. |
FIDO Alliance distinguishes synced and device-bound passkeys. Both use cryptographic credentials for signing in. The distinction concerns where the credential can be used and stored; the word passkey alone does not tell you what will happen when you replace your phone.
Consider a hypothetical user who can still unlock an exchange account on an old handset. A successful sign-in there answers one question: access works today. It does not demonstrate that the replacement handset has the same credential. Treating those two observations as interchangeable is the avoidable mistake.
Test the replacement before wiping the original
There is a concrete example in Microsoft’s guidance for Entra ID: passkeys in Microsoft Authenticator are device-bound and cannot be synced. That statement describes this implementation. It should not be read as a claim that every Microsoft account, password manager or passkey behaves the same way.
The comparison changes the question to ask your account provider. Instead of asking only whether it supports passkeys, ask which type you registered and how another sign-in method is added. FIDO describes both categories; Microsoft illustrates why the application implementing them matters. Neither source establishes the recovery rules of your particular exchange.
A practical rehearsal is to open the genuine service on the replacement device while the old one is still available. Follow that service’s instructions for registering or restoring access. If it asks you to create a separate credential, do not assume a cloud backup has already done the job. Record which device you tested, rather than recording a secret.
The same distinction applies when buying a spare security key: owning a second object is not evidence that an account recognises it. Check registration with the service. Keep its documented recovery route available, and avoid erasing the original device until you have established how you will sign in without it.
