Passkey recovery flow

What happens when the only enrolled device is gone, and why the answer is not an email link.

Accepted · shipped 2026.9.1 · owner: jm

Problem

Passkeys are device-bound, which is the property that makes them worth having. It is also the property that makes losing the device an account-recovery problem with no self-service answer that preserves the security guarantee.

Why not an email link

An emailed recovery link makes the mailbox a superset of every account it can recover. That is the failure mode passkeys exist to close: it reintroduces a bearer credential in a channel the user does not control, and it does so at exactly the moment the account is most likely to be under attack, because an attacker who has the mailbox is the common case in account takeover.

What we do instead

• Enrolment prompts for a second device at setup. One device is treated as an incomplete enrolment, not a finished one.
• A recovery code is issued once, at enrolment, and is not recoverable. It is a bearer credential, but it is one the user chose where to put.
• With neither a second device nor the code, recovery is manual and slow on purpose. The delay is the control.

Documented for users on the account help host under Recovery.